Software Supply Chain Security with Sigstore

How do you ensure the software running in your production environment hasn't been tampered with? Modern software delivery relies on complex supply chains, making securing your build artifacts and container images more critical than ever. This text-based course provides a clear, step-by-step introduction to securing your software supply chain using the Sigstore ecosystem, ensuring you can verify the integrity of everything you deploy. You will gain a solid foundation in cryptographic signing and verification, moving from basic concepts to practical configurations. By reading through detailed explanations and studying real-world configuration examples, you will learn how to protect your code, generate Software Bills of Materials (SBOMs), and automate security checks in your delivery pipelines. What you'll learn: - Understand the core concepts of software supply chain security and the SLSA framework - Generate and verify cryptographic signatures for container images and binaries using Cosign - Implement keyless signing using identity providers for seamless, secure workflows - Create, manage, and sign Software Bills of Materials (SBOMs) to track dependencies - Configure automated verification policies within modern CI/CD pipelines - Query public transparency logs to audit and verify artifact history The course begins with essential terminology, explaining why supply chain security matters and how cryptographic signing protects your workflows. You will then progress through practical, written guides on using the Sigstore toolset to secure artifacts, manage metadata, and integrate automated checks into your development lifecycle. This course is designed for software developers, DevOps beginners, and system administrators who want to understand modern software security practices. No prior experience with cryptography or security engineering is required. Start building trust and integrity into your software delivery process today.