The safeguards map / 3.7 Admission and owner settings
Sigstore
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
Open source tools (Cosign, Fulcio, Rekor) to sign and verify software artifacts such as container images, with signing events recorded in a public transparency log.
Where it sits
3.7 Admission and owner settings (primary): Signs software artifacts and verifies their signatures against a signer identity the verifier names, so a deployer can decide once whether an artifact may be used.
to securely sign and verify software artifacts such as release files, container images, binaries
captured
For identity-based verification of a container image, use the following command:
captured
4.2 Evidence preservation: Records signing events in a public transparency log that cannot be altered unnoticed, so the signing history can be audited later.
Signing events are recorded in a tamper-resistant public log so software developers can audit signing events.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who make itthose who distribute itthose who run it
- Runs
- by handin CI
- Policy comes from
- owner-entered settings
Handoffs
produces Provenance and signatures: Sigstore signatures
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.