Published on
How does it work, and why is it important?
If you have paid attention to supply chain security in 2021, you've likely heard a lot about Sigstore. If you are still not sure exactly what it is, do not worry. We will provide an explanation that even a child can follow.
Introduction: Sigstore & the Supply Chain
Sigstore is not one thing; it is a growing suite of integrated supply chain security tools and services. It builds on top of other long-standing projects, which address aspects of the SLSA threat model.
Sigstore aims to become the industry standard as a differential solution. It does not force a particular workflow on developers as a panacea to all supply chain problems. On the contrary, it is the first project to recognize that one way of conducting supply chain security will not do.
Why not? Because all of our large projects have dependencies with just one volunteer maintainer. The security of a system is only as good as the security of its weakest link. The sophistication of any given approach slows its adoption and grows the attack surface. Volunteer maintainers do not have sufficient time to invest in deploying and maintaining enterprise-level supply chain solutions for the one small package they wrote over a weekend last year.
The Sigstore team understands this better than anybody. It started with usability as the first barrier to supply chain security:
According to Dan Lorenc, "The most important part of Sigstore is usability. We need to make everything as easy to use as possible, or it will not get adopted. It needs to be so easy people don't even realize they're using it."
If it is supposedly more usable than anything else, why is it so hard to understand? We get the frustration. Do not fret. Few can explain ACME TLS either, but it provides TLS certificates to over 80% of the Internet. Sigstore aims to become the ACME of global supply chain security.
You likely found this article while trying to understand better if your team can benefit from it. How can you evaluate Sigstore for your project without a firm grasp of its value proposition? Is there a simple explanation?
Explanation: Kids like sand-free cakes
You own a bakery. You buy ingredients from the farmer's market and bake cakes. People like your cakes and order them from all over the world, so you put them in boxes and give them to the mail person. The mail person takes your cakes to the airport. The plane flies your cakes to other countries, where other mail persons deliver them to people's homes. Everybody is happy.
The wicked witch does not like it when people are happy. She decided to find as many ways to make a tasty cake as yucky as possible. She starts putting sand everywhere. She put the sand into sugar and flower at the market. She put the sand into your pockets, so some sand gets into the bowl when you mix ingredients. She filled the bakery kitchen shelves and refrigerator with sand, which gets into the cakes during boxing and storage. She climbed into the mail truck and sprinkled sand inside the cake boxes. She hid in the plane and sprinkled sand on all the cakes which were there. Now almost all the cakes are yucky, and nobody is happy.
You asked your wise friend to help deal with the wicked witch. The wise friend says that there are three things you can do to stop the wicked witch:
- You can add a list of ingredients to each cake that others can check and sign. (attestations)
- You can calculate the weight of the cake. If there is sand in it, it will be a little heavier than the recorded weight. (hashes and signatures)
- You can regularly announce on TV the ingredient list and the weight for each type of cake you bake: "Behold, we have a cake announcement!" (transparency log)
If you do those things, anybody, you, the mail persons, the pilot, or the people who ordered cakes can detect if the evil witch was active that day and put sand in the cakes.
While the kids eat cake, the adults talk.
Sigstore provides an easier way to seamlessly issue and validate signatures from constituent dependencies, including base images, all the way to the final deployed application artifact. It includes a global transparency log, Rekor, as an option for tracking the life of each artifact and its ingredients. It allows for key-less Open ID Connect signing as an option for volunteer maintainers.
Since every attestation or supply chain step is associated with the final product, zero-trust CI/CD pipelines are possible. Furthermore, if artifacts that contain less certain attestations, like single-developer OIDC, must be rejected, anybody can do so in an automated fashion. Now for some cake!
Read more from:
Security Culture