►
From YouTube: Keynote: The Meteoric Rise of Sigstore - Luke Hinds, Senior Principal Software Engineer, Red Hat
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Keynote: The Meteoric Rise of Sigstore - Luke Hinds, Senior Principal Software Engineer, Red Hat
Since the sigstore project was started back in 2020, the adoption and acceleration of the sigstore project has exceeded by far any original expectations. This keynote will outline the meteoric rise of sigstore over the past two years, as major communities seek to integrate with the project and improve their supply chain security posture.
A
Good
to
see
everybody,
and
so
today,
I
kind
of
give
her
going
to
give
a
context
for
what
helped
the
adoption
I
believe.
And
you
know
what
have
been
our
sort
of
guide
rails
as
a
project,
our
sort
of
mission
statement,
so
to
say,
and
then
our
relatively
fastly
move
on
to
the
adoption
that
we've
seen
within
Sig
store
around
the
community
contributions,
people
that
are
starting
to
adopt
the
project.
A
So
I
guess
a
few
folks
know
me:
I'm
Luke,
I
work
at
red
hat
in
the
office
of
the
CTO
and
I
have
a
few
other
gigs
as
well
I'm
on
the
kubernetes
security
response
team.
So
we
triage
the
vulnerabilities
as
they
come
in,
manage
the
bug
Bounty
program,
the
open,
ssf,
tack
and
I'm
involved
in
six
store
as
well.
So
I
help
maintain
some
of
the
projects
been
working
on
the
rust
project.
Quite
a
bit
recently.
A
Okay
so
a
quote
that
really
holds
true
to
Tech,
okay,
okay,
a
lot
of
the
time
Tech
is
a
reinvention
of
a
previous
sizable
impact
that
another
technology
has
had,
or
an
idea
essentially
and
with
six
store.
It's
pretty
much.
A
continuation
of
that
and
I
mean
we
see
this
all
the
time.
We're
at
kubecon
and
kubernetes
was
obviously
built
around
container
orchestration
and
then
containers
were
built
around
name
spaces.
So
there's
somebody
originally
Avi
that
wrote
this
concept
and
namespaces
developed
it
into
the
into
the
kernel.
A
So
you
can
see
we
often
re-spin
and
reuse
ideas
that
already
existed,
and
we
did
a
degree
of
that
with
six
dollar,
not
only
technology,
but
not
only
for
the
technology,
but
for
the
for
the
the
the
adoption.
Okay,
looking
at
other
communities
that
have
got
good
abduction.
Okay,
so
one
example
is
HTTP.
A
Okay,
so
HTTP
is
arguably
the
most
I
might
not
be
right
here,
but
it's
one
of
the
most
popular
popular
protocols,
widely
leveraged
protocols
on
the
internet
and
the
HTTP
World
required
to
make
a
shift
to
a
more
secure
form
of
the
protocol
https.
So
the
S
denotes
secure.
I'm
imagining
a
lot
of
security
folks
here
you
already
know
that,
but
just
so
we
can
get
everybody
on
the
same
playing
field,
and
so
they
were
tasked
with
achieving
this.
Everybody
was
essentially
everybody.
That's
involved
in
in
writing,
applications
and
infrastructure
for
the
internet.
A
Now
this
was
incredibly
painful.
Incredibly
painful,
perhaps
that's
too
harsh,
but
it
was
a
painful
process.
Okay,
because
habits
have
become
very
ingrained
when
something
works
generally,
people
don't
want
to
disrupt
that.
They
don't
want
to
change
systems,
because
there
might
be
possible
ramifications
that
you've
not
speculated
might
happen
certain
edge
cases
that
might
play
out,
and
so
you
also
have
that
apathy
of
it
works,
which
we
get
a
lot
within
it.
If
something's
kind
of
acceptable,
it
might
not
be
perfect,
but
it
works
and
everybody's
using
it
and
the
painful
elements.
A
A
You
can
see,
obviously
it's
a
web
UI.
You
can
generate
your
private
key
there
copy
and
paste
it
stick
it
wherever
a
Word
document,
Google
doc,
I,
don't
know
okay,
and
so
the
ux
was
like
I,
say,
not
desirable.
Okay,
it
have
been
improved
and
then
there
was
also
a
element
of
it
costs
money.
Okay,
so
I
was
quite
surprised
at
this
really
do
you
see
what
I
mean
for
receiving
some
bits
in
a
document
you
know
some
bits
and
a
certificate
and
so
forth.
A
A
Okay
and
a
lot
of
this
was
driven
by
not
solely,
but
it
was
driven
by
a
group
called
The
isrg,
the
Internet
Security
research
group-
and
they
came
up
with
this
idea
of
a
project.
Let's
encrypt,
okay
and
let's
encrypt
essentially,
would
provide
tools
to
automate
and
ease
the
procurement
of
SSL
or
TLS
certificates.
Okay,
so
you
could
use
them
to
protect
your
your
endpoints,
your
network,
endpoints
others
also
help
this
sort
of
cloudflare.
Multiple
sort
of
cloud
providers
started
to
provide
free
certificates
for
users
as
well.
A
and
then
in
parallel
to
that,
these
are
some
measurements
that
I
gathered
from
chrome.
You
can
see,
certain
operating
systems
have
actually
hit
100
percent
around
the
propagation
and
the
and
the
the
leveraging
of
https
protection
system.
I
found
quite
interesting
here
is
the
green
line.
Okay
and
that's
actually
Linux
and
I
would
have
thought
Linux
users
would
be
up
higher.
My
own
idea-
and
somebody
can
pull
me
up
about
this-
if
you
think
I'm
wrong,
I
reckon
it's
developers
hitting
localhost
and
http127.0.0.1.
A
Perhaps
that's
an
explanation,
I'm,
not
sure,
but,
as
you
can
see,
we've
had
that
lovely
upward
trajectory
to
signify
adoption.
Okay,
then,
at
the
same
time,
what
happened
was
the
browsers
started
to
Corner
http,
so
they
moved
around.
They
smelt.
They
smelt
the
blood
in
the
air.
Okay,
okay
started
to
come
up
with
these
messages
to
convey.
This
is
not
somewhere,
you
want
to
go
essentially,
you
know
it
became
like
nowadays.
If
you
go
onto
a
HTTP
site,
it
kind
of
feels
like
you,
don't
really
want
to
put
your
personal
details
in
just.
A
Do
you
see
what
I
mean
it
does
it
feels
unsafe,
and
the
success
of
that
was
largely
due
to
several
things.
Essentially,
so
it
was
ease
of
use.
So
we
had
certbox
the
tool
in
to
provide
an
easy,
simple
ux
for
the
user,
and
then
it
was
free,
so
there's
no
charge
at
all
no
Financial
impact,
as
we've
seen
previously.
There
was
that
sort
of
99
dollars,
procuro
certificate,
okay
and
then
the
the
you
know
us
early
folks
that
were
working
on
the
six
door.
A
The
idea
that
we
had
was
what,
if
we
could
replicate
this
scenario,
this
success
that
happened
around
https
for
the
software
supply
chain.
So
just
as
you
now
have
the
experience
where
HTTP
the
the
older
insecure
implementation
of
the
protocol
feels
dangerous,
okay,
socially
unacceptable,
it
was
that's.
The
same.
Idiom
would
apply
when
you
consume
an
artifact.
That's
that's
on
sign
and
has
no
provenance.
A
A
A
And
then,
at
the
same
time,
make
it
free
okay,
so
you
might
have
a
developer
a
12
year
old
in
Bangalore
that
needs
to
sign
their
container.
At
the
same
time,
he
might
have
a
huge
cork
in
San
Francisco.
They
should
get
the
same
level
of
access.
You
know
there
should
be
no
special
tiers
for
payment,
and
so-
and
the
other
thing
was
that
this
would
be
a
public
good
service.
We
saw
that
as
key
to
the
adoption
okay,
so
it
would
be
a
vendor
neutral
for
the
good
of
all
public
service.
Okay,.
A
So,
let's
see,
how
did
we
get
on
okay,
so
I've,
drawn
together
a
quick
timeline
of
adoption
which
I'll
skip
through
because
I
see
time
is
coming
up,
so
in
I
can't
see
the
dates
from
here
so
more
or
less
around
summer
of
20.
The
recall
project
was
started
shortly.
After
that
we
got
a
live
instance
of
recore
running
for
people
to
use.
Okay,
it's
still
an
experimental
at
this
stage
then
came
along
our
first
client
implementation,
cosine.
Okay,
it's
a
project
that
Dan
Lawrence
had
worked
on.
A
We
then
had
forcio,
so
the
idea
of
keyless
came
up.
It's
wonderful
idea
of
of
no
longer
having
to
manage
the
private
key,
so
we
started
to
build
out
fulsio
from
there
shortly
after
that,
the
project
was
donated
to
the
Linux
Foundation,
okay
and
we
then
a
certain
amount
of
period.
After
that
we
went
into
the
open
ssf.
That
became
our
new
home
I'm
hacking
through
this
quickly,
because
the
time's
coming
up
and
another
good
Milestone
was
K8
standardized
on
six
door.
A
So
it's
the
star
Gaza
release,
so
I've
just
been
shown
a
stop
sign.
Other
communities
came
on
and
then
we
of
course
have
GA,
which
Santiago
just
announced
okay
and
from
there.
We
then
move
into
the
future
where
we
have
npm.
Looking
is
very
promising
that
they're
going
to
come
on
board,
there's
work
to
bring
on
other
communities
as
well,
and
we
have,
of
course
you
can
see
our
contributor
growth
is
fantastic.
We're
much
we're
really
we're
really
sort
of
increasing
our
contributors
as
a
as
opposed
to
sort
of
losing
them
commit
rates.
A
Of
course,
all
of
these
metrics
are
going
in
the
direction
that
we'd
expect
them
to
and
last
of
all
we're
coming
up
for
six
million
entries
on
recon.
You
can
see
that
lovely
Spike
towards
the
end,
so
so
the
momentum
is
continuing.
You
know
we
continuing
to
get
that
momentum
and
I
believe
we're
only
just
getting
started
and
I've
just
got
to
stop
because
I
just
reached
the
end
already.
So
thanks
everybody
enjoy
the
conference
and
great
to
see
you
all.