Hacker GitHub

← All repos

sigstore/cosign

View on GitHub ↗ ★ 6,406 Go

Code signing and transparency for containers and binaries

11 mentions on Hacker News by 9 people: 2 stories, 9 comments · first 2021-03-09 · latest 2024-05-25

Mentions per year 11 mentions · busiest year 2021 (5)
20082026
AllStoriesComments NewestTopOldest
  1. …else sees for the same `$path@$version`. Though I guess users can utilize existing solutions like https://github.com/sigstore/cosign or rekor (mentioned elsewhere itt).
    comment by infogulch · 2024-05-25 · in Abusing Go's Infrastructure
  2. Yes, see https://github.com/sigstore/cosign/blob/main/USAGE.md for one example
    comment by dilyevsky · 2022-10-05 · in Kubernetes Hardening Guidance [pdf]
  3. …sigstore’s trust root, the deeper layer of keys and trustees and what we use to check authenticity. https://github.com/sigstore/cosign > our certificate then comes back to sigstore, where sigstore exchanges keys, asserts your identity and…
    comment by westurner · 2022-07-15 · in Freezing Requirements with Pip-Tools
  4. ▲ 3
    Container signing: Why not use blockchain?
    story by xenocratus · 2022-03-04 · 0 comments
  5. …managers are storing packages. So it might be not as trivial. Or perhaps I'm missing something? https://github.com/sigstore/cosign
    comment by syrusakbary · 2022-03-02 · in Show HN: WAPM – WebAssembly Package Manager
  6. Thanks for the cosign mention! Maintainer here. The link is github.com/sigstore/cosign for anyone reading along!
    comment by dlor · 2022-02-21 · in How to optimize the security, size and build speed of Docker images
  7. …code signing. I'm not sure if arbitrary binaries are supported fully yet, but it's being worked on. https://github.com/sigstore/cosign
    comment by verdverm · 2021-10-13 · in Ask HN: Reputable code signing service? For arbitrary payloads
  8. Using cosign/sigstore to sign release artifacts https://github.com/sigstore/cosign and instructions for validating signature on download could be a good option here.
    comment by raesene9 · 2021-09-05 · in Kubescape – tool for testing if Kubernetes is deployed securely
  9. ▲ 5
    Signing Git Commits – Three Ways
    story by di · 2021-05-19 · 0 comments
  10. …to the timestamps by using Transparency Logs. We have some demos here on how to sign git commits: https://github.com/sigstore/cosign/blob/main/FUN.md The idea is that you can use short-lived keys, bound to certificates via an ACME-style…
    comment by dlor · 2021-03-31 · in What does a PGP signature on a Git commit prove?
  11. …give feedback. If you want to try it out to sign containers this branch has everything you need: https://github.com/sigstore/cosign/pull/53
    comment by dlor · 2021-03-09 · in Sign of the primes: Linux Foundation serves up free code-signing service