Building and distributing software that is secure throughout its entire lifecycle can be challenging, leaving many projects unprepared to build securely by default. Attacks and vulnerabilities can emerge at any step of the chain, from writing to packaging and distributing software to end users. Sigstore is one of several innovative technologies that have emerged to improve the integrity of the software supply chain, reducing the friction developers face in implementing security within their daily work.
Training Course
Securing Your Software Supply Chain with Sigstore (LFS182x)
Who Is It For
This course is designed with end users of Sigstore tooling in mind: software developers, DevOps engineers, security engineers, software maintainers, and related roles. To make the best of this course, you will need to be familiar with Linux terminals and using command line tools. You will also need to have intermediate knowledge of cloud computing and DevOps concepts, such as using and building containers and CI/CD systems like GitHub Actions.
read less
read more
What You’ll Learn
This course will introduce you to Cosign, Fulcio, and Rekor, the tools under the Sigstore umbrella, explaining how they support a more secure software supply chain. You will learn how to employ these tools throughout your software development, testing, and distribution processes. Additionally, those who use or implement your software will be able to verify its authenticity through tamper-resistant public logs.
read less
read more
What It Prepares You For
Upon completing this course, you will be able to inform your organization’s security strategy and build software more securely by default.
read less
read more
Welcome to LFS182x!
Chapter 1. Introducing Sigstore
Chapter 2. Cosign: Container Signing, Verification, and Storage in an OCI Registry
Chapter 3. Fulcio: A New Kind of Root Certificate Authority For Code Signing
Chapter 4. Rekor: Software Supply Chain Transparency Log
Chapter 5. Sigstore: Using the Tools and Getting Involved with the Community
Final Exam (Verified Certificate track only)
Prerequisites
- Labs will work on Linux and macOS
- Administrative access to enable installing software
- We are assuming a local machine, but these commands should work on a Linux cloud instance as well
- Internet connection
- We recommend at least 2GB of RAM and a 64-bit CPU.
- You should have the latest version of Docker and Docker Compose installed, and an account on Docker Hub. At the time of writing (June 2022), Docker Engine should be version 20.10 and Docker Compose should be version 2.6. If you are on macOS, you will need to use Docker Desktop; refer to the official documentation for your operating system to ensure that your system meets the necessary requirements. Docker Desktop should be version 4.8 or higher.
- You should have the latest version of Go installed, at the time of writing this is 1.18 (June 2022).
Mar 2023
Clear examples, and brief but clear explanations for the technology involved.
Jan 2023
Very clear and interesting content. Great step-by-step walkthroughs, in which I picked up some nice new tools.
Jan 2023
The breakdown of cosign, fulcio, and rekor was really helpful.
Nov 2022
I thought it was informative and useful.
Oct 2022
I liked learning about sigstore and its components in detail, to use in my open source projects.
$0
Course only
Online, Self Paced
8 Hours of Course Material
Hands-on Lab Exercises
Discussion Forums
7 Weeks of Free Access to Online Course (Audit Mode)
Optional Paid Certificate of Completion
