sigstore/fulcio
View on GitHub ↗ ★ 897 Go
Sigstore OIDC PKI
4 mentions on Hacker News by 4 people: 0 stories, 4 comments · first 2021-08-09 · latest 2024-10-17
20082026
-
Specifically, the CA signing the code certificates (that are valid for 10 minutes) is https://github.com/sigstore/fulcio .
comment by Diti · 2024-10-17 · in Removing PGP from PyPI (2023) -
…adding themselves, to have the same capability (several other providers are there as well). https://github.com/sigstore/fulcio/pull/1097
comment by decodebytes · 2023-04-19 · in NPM Provenance Public Beta -
…author. Fulcio grants a time-stamped certificate, a way to say you’re signed in and that it’s you. https://github.com/sigstore/fulcio > You don’t have to do anything with keys yourself, and sigstore never obtains your private key. The…
comment by westurner · 2022-07-15 · in Freezing Requirements with Pip-Tools -
…walled gardens. It doesn't say this on the announcement, but looking at the actual PKI service ( https://github.com/sigstore/fulcio ), it seems to be entirely possible to self-host the service and roll your own CA.
comment by nonameiguess · 2021-08-09 · in Sigstore – A new standard for signing, verifying and protecting software