Services and Projects from reproducible-builds.org

[Patrick]

@HulaHoop

sigstore, a project that endeavours to offer software signing as a “public good, [the] software-signing equivalent to Let’s Encrypt”. The two posts, the first entitled Sigstore: A Solution to Software Supply Chain Security outlines more about the project and justifies its existence:

Software signing is not a new problem, so there must be some solution already, right? Yes, but signing software and maintaining keys is very difficult especially for non-security folks and UX of existing tools such as PGP leave much to be desired. That’s why we need something like sigstore - an easy to use software/toolset for signing software artifacts.

The second post (titled Signing Software The Easy Way with Sigstore and Cosign) goes into some technical details of getting started.

Got a dedicated forum thread for that:

sigstore for improving verification of downloads?

Sigstore for Whonix? Since normal people don’t understand signing keys, signatures or how to check things properly – and those that do often don’t bother – this could be useful for Whonix in the future. It would help to overcome the first major obstacle to running the platform i.e. confirming that what is being downloaded and due to be installed is the legitimate platform to begin with. It looks like people would just need to check the binary against “transparency logs” to check it is legitima…