►
From YouTube: Lightning Talk: Sigstore Meets Ferris: Rust in Supply Chain Security - Lily Sturmann, Red Hat
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Lightning Talk: Sigstore Meets Ferris: Rust in Supply Chain Security - Lily Sturmann, Red Hat
Sigstore is gaining momentum as a new standard for signing, verifying and protecting software. It aims to improve supply chain technology for anyone using open source projects: it is created for open source maintainers, by open source maintainers. Rust is a systems programming language known for its speed and built-in emphasis on security. While many of the tools in the Sigstore ecosystem are written in Go, some portions of these tools are now being ported to Rust, which will allow them to be available for more diverse use cases and environments. This session will cover the use of Rust in Sigstore and the integrations and use cases this enables. Note: This presentation will differ from the Devconf.us talk of the same name, "Sigstore Meets Ferris," in that the Devconf one is aimed more at a beginner audience and includes more of a recap of what sigstore is, which will not be the purpose of this talk.
A
A
So
we
are
here
because
we
know
that
the
software
supply
chain
can
be
quite
complex
and
we
know
that
each
step
in
this
chain
matters
because
each
step
can
impact
the
end
resulting
application.
So
what
we
don't
want
is
those
nasty
green
things
on
the
screen
representing
vulnerabilities
to
enter
any
part
of
this
supply
chain
and
end
up
in
the
end
product
or
application.
A
So
that
is
why
Sig
store
is
here.
Sig
store
aims
to
make
software
signing
ubiquitous
aims
to
make
the
finding
of
artifacts
involved
in
the
software
supply
chain
ubiquitous,
and
it
does
so
by
offering
all
of
these
tools
that
the
other
talks
today
have
already
done
a
great
job
of
summing
up,
so
I'm
not
going
to
go
into
depth
on
each
of
them.
Thank
you
to
the
previous
speakers
to
who
went
into
those
deep
Dives
that
were
really
good
on
these
Technologies
I.
A
We've
got,
for
example,
Sig
store
python,
six-door
Java,
and
the
idea
behind
these
is
that,
in
order
to
make
signing
more
ubiquitous,
we
want
to
offer
these
libraries
to
developers
who
are
coding
in
all
of
these
different
languages
so
that
they
can
pull
that
in
to
their
source
code
and
use
these
tools
and
make
them
available
for
a
wider
variety
of
use.
Cases.
A
A
So
traditionally
there
was
this
awkward
tension
between
when
you're
choosing
a
programming
language
you
had
to
make
the
choice
between
languages
that
are
speedy
and
reliable
in
their
performance
and
are
really
good
for
systems
programming.
For
that
reason
versus
other
languages
that
have
a
memory,
safety
capabilities
through
mechanisms
like
garbage
collection,
but
are
much
less
performant,
and
that's
not
really
a
choice
that
anyone
anyone
wants
to
make
so
rust
actually
offers
the
best
of
both
of
these
worlds.
A
It
has
a
good,
reliable
performance
and
also
built-in
memory
safety
mechanisms
enforced
by
the
compiler,
among
many
other
things
that
it
offers.
So
this
is
why
many
security
conscious
projects
today
are
already
using
rust
in
some
capacity,
and
this
was
the
idea
behind
making
Sig
store
and
some
of
the
six-door
tools
available
in
Ross,
so
that
they
can
be
pulled
in
as
a
library
into
those
projects.
A
And
this
is
why
we
have
introduced
Sig
store
RS.
This
is
obviously
complementary
to
the
original
tools
which
are
still
available
in
golang
and
these
other
language
tools
that
I
pointed
out
earlier
as
well.
So
we
have,
even
though
we're
still
very
much
in
active
development.
We
have
a
lot
of
features
available
that
people
can
already
use.
A
For
example,
we
have
signature
verification
for
oci
images,
we've
got
integration
with
fulsio
using
the
oidc
flow
and
recently
in
the
past
month
or
two
we've
actually
now
got
a
key
interface
that
has
key
generation
and
signing
for
blobs,
and
we've
also
got
integration
with
the
recore
transparency
log.
So
that
is
pretty
exciting
and
the
other
thing
that
I
noticed
when
I
was
creating.
This
slide
is
that
the
last
time
I
gave
a
slightly
different
version
of
this
talk,
which
was
just
like
two
months
ago.
A
The
crates.io
downloads
for
six
store
RS
were
actually
I,
think
in
the
low
1000.
So
that's
actually
a
5x
Improvement
since
that
time.
So
that's
pretty
cool
Ferris
is
really
happy
about
it
about
it.
So
the
moment
that
we
have
been
waiting
for
we're
going
to
show
a
quick
demo
and
first
of
all,
please
tell
me
whether
I
should
make
this
larger
or,
if
you
can
see
it
thumbs
up
before,
I
can
see
it
well.
Okay,
great
thank
you.
You
all
actually
respond,
so
I
will
first
explain.
A
We
have
basically
a
demo
repository
that
we
call
Ferris
sign.
It
is
not
part
of
six
door,
but
it
pulls
in
the
six
door,
RS
library
to
basically
show
how
it
can
be
used
and
we're
going
to
go
through
a
flow
that
will
take
an
example.
File
generate
some
ephemeral
keys
to
sign
it.
It'll
go
through
the
full
Co
flow
that
we
covered
in
the
earlier
talk,
so
we're
going
to
get
a
full
seal
signing
certificate
and
create
a
record
entry
that
has
the
signature
and
the
signing
certificate
embedded
in
there.
A
I
do
want
to
point
out
just
for
the
purposes
of
this
demo,
we're
not
going
through
the
six
step,
verification
that
you
should
do
if
you
are
actually
being
very
security,
conscious
that
we
were
talking
about
in
the
earlier
talk.
This
is
really
just
going
to
extract
the
signature
and
public
key
and
verify
that
the
signature
is
correct,
just
to
show
the
the
filthio
and
the
recour
integration
in
Sig
store,
RS.
A
Currently,
so,
first
we're
going
to
run
this
command,
and
what
you
see
is
that
we
will
first
sign
we're
going
to
sign
just
an
example
file.
This
could
be
anything
on
the
system.
I
think
this
does
Boo
in
it,
but
we're
going
to
pretend
that
it's
important
and
we're
going
to
sign
it,
and
then
this
flag
is
telling
us
that
afterwards
we
will
also
verify
it,
and
these
other
two
flags
at
the
end
are
optional,
but
they
basically
dump
out
the
full
SEO
signing
certificate
as
well
as
the
signature
in
case.
A
So
this
was
the
oadc
and
we
have
received
an
oidc
token
for
the
email.
This
is
my
email
that
you
see
here.
We
request
and
we
get
a
signing
certificate
from
fulsio
that
has
the
email
embedded
in
it.
We
dump
out
the
certificate
data
and
the
signature
to
the
local
system,
and
then
we
bundle
this
all
up
and
send
it
to
recore
with
a
created
entry.
So
this
is
going
through
Sig
store,
RS,
creating
this
entry
for
us
we've
got
lots
of
data
here.
A
A
This
is
the
certificate
it's
in
the
recore
hash
recorder,
hash
record
the
entry
as
it
as
the
public
key.
We
parse
the
certificate.
We
get
this
public
key
and
then
we
use
that
to
see
that
our
blob
was
signed
correctly
and,
as
you
can
see,
verification
did
succeed,
which
is
fantastic.
That's
what
we
want
to
see.
So
that
is
one
of
several
flows
that
we
can
go
through.
A
So
last
time
we
signed
a
blob
and
we
verified
the
blob.
This
is
the
keyless
blow
and
it
is
caveat.
It
is
still
using
cosine
to
sign
the
image,
but
then
it's
going
to
use
the
rust
version
to
verify
it
and
just
for
context,
I,
think
yeah
here
this
is
just
in
GitHub
container
repository
I
have
this
image?
It's
very
simple:
it's
just
for
the
demo,
and
this
is
where
we're
going
to
push
that
signature
and
where
we're
going
to
check
that
it
was
signed
correctly.
A
A
Oh
yeah,
so
I
had
signed
it
earlier
so
now
we're
going
to
use
six
store
RS
to
make
sure
that
this
can
be
correctly
verified
and
it
does
say,
image
was
successfully
verified.
It
has
all
of
this
other
output,
which
looks
alarming,
but
it's
actually
okay,
so
image
successfully
verified
with
rust,
oci
image,
as
well
as
a
blob,
it
does
work.
Thank
you
very
much.
A
I
will
do
one
more
thing
which
is
to
let
you
know
that
we
have
an
overwhelming
number
of
ways
to
get
in
touch.
This
is
the
one
that
is
rust
specific.
So
we
have
a
channel
on
the
six
door.
Slack
instance
that
is
Sig
store,
RS,
and
then
there
are
all
of
these
other
resources
if
you're
interested
in
Sig
store
in
general,
if
you're
not
already
joined
up
to
these,
please
do
so
and
get
in
touch
if
you
have
any
interest.