#RomHack2021 - Luke Hinds - sigstore, software signing for the masses!

Speaker Background and Motivation

Luke Hinds of Red Hat's Office of the CTO describes sigstore as a lockdown-era project addressing secure software supply chains. His team works on supply-chain security and he volunteers on the Kubernetes security response team.

Supply Chain Anatomy

A typical chain runs from developer commits through human review, CI build systems, security scanners, and artifact publication to downstream consumers—including critical sectors like health, banking, and infrastructure. Sonatype reported a 650% increase in supply-chain attacks, mostly targeting open source.

Common Attack Patterns

Hinds explains rollback and replay attacks where proxies serve outdated vulnerable package versions, and key-compromise attacks exploiting trust-on-first-use models that make undetected key theft difficult. He also covers the SolarWinds incident, where a backdoored signed DLL was accepted because its signing certificate was compromised.

Sigstore Direction

The talk positions sigstore as the response to these signing and trust failures, though the available transcript ends before detailed technical coverage of the project.