Software Supply Chain Security with Sigstore

Software supply chain attacks are on the rise, making it critical to verify the integrity of every dependency and artifact you deploy. Understanding how to secure your code from commit to production is no longer optional—it is a core requirement for modern software delivery. This text-based course equips you with the fundamental skills to implement robust security practices using the open-source Sigstore ecosystem. You will learn how to sign, verify, and monitor software artifacts to ensure they remain untampered throughout the delivery pipeline. Through clear written explanations and configuration examples, you will master the principles of cryptographic verification. What you'll learn: - Understand the core concepts of software supply chain security and the SLSA framework. - Configure and use Cosign to sign and verify container images and digital artifacts. - Implement keyless signing using Fulcio and Rekor for seamless cryptographic verification. - Generate and integrate Software Bill of Materials (SBOMs) into your security workflow. - Verify the integrity of third-party dependencies before integration. - Establish transparency logs to monitor and audit digital signatures over time. You will start by exploring foundational security definitions and the mechanics of modern supply chain threats. From there, you will progress through structured written guides and real-world configuration examples to set up cryptographic signing and verification pipelines. This course is designed for software developers, DevOps beginners, and security enthusiasts who want to establish a solid foundation in supply chain security without needing prior cryptography experience. Start building a safer, more resilient software pipeline today.