Example of GitHub Actions, goreleaser and cosign to release a Go based CLI program.

(landing area for upstream contributions and carried patches)

A Rekor crawler and monitor

Kubernetes admission webhook that uses cosign tools Container Sign Verify

Demo to showcase how to build a golang application using ko. Sign and push the image to the container registry using https://sigstore.dev. Apply policy controller on Kubernetes to allow only signed images.

Supply Chain Security does not need to be difficult

Tools & services used to help in the development flow of sigstore

Pulumi GitHub Sync for sigstore

Google Container Analysis data import utility, supports OSS vulnerability scanner reports, SLSA provenance and sigstore attestations.

Sign your artifacts, source code or container images using Sigstore tools, Save the Signatures you want to use, and Validate & Control the deployments to allow only the known Sources based on Signatures, Maintainers & other payloads automatically.

Go library for Sigstore signing and verification

Stream, Mutate and Sign Images with AWS Lambda and ECR

Transparenty Immutable Container Image Tags

🔍 Rekor transparency log monitoring and alerting

Go library for Sigstore signing and verification

Example goreleaser + github actions config with keyless signing and SBOM generation

A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.

Plugin for Helm to integrate the sigstore ecosystem

🔮 ✈️ to integrate OPA Gatekeeper's new ExternalData feature with cosign to determine whether the images are valid by verifying their signatures

Enabling Software Supply Chain Security Capabilities in ArgoCD