Ce contenu n'est pas disponible dans la langue sélectionnée.
Chapter 12. Manage secure signatures with sigstore
You can use the sigstore project with OpenShift Container Platform to improve supply chain security.
12.1. About the sigstore project
The sigstore project enables developers to sign-off on what they build and administrators to verify signatures and monitor workflows at scale. With the sigstore project, signatures can be stored in the same registry as the build images. A second server is not needed. The identity piece of a signature is tied to the OpenID Connect (OIDC) identity through the Fulcio certificate authority, which simplifies the signature process by allowing key-less signing. Additionally, sigstore includes Rekor, which records signature metadata to an immutable, tamper-resistant ledger.
