Sigstore
Named by 17 kept items in this workspace.
13 items name it under tools, 3 under classification.technologies and 1 under affected products.
Search every workspace for Sigstore. It matches the name as written, so it can find other things that share it.
The items that name it 17
Append-only public log where the release's provenance attestation was recorded.
Signing framework for build attestations; signatures still pass on a build that restored a tampered cache entry
Tool cited as existing to fix supply chain security issues (signing/transparency).
Used by the payload's provenance path to sign and log an in-toto SLSA statement for the modified opensearch package
keyless signing infrastructure used for glsec release signing (no public key to fetch or rotate)
signing and verification infrastructure behind the 'verified' confidence tier (transparency-log inclusion checks, signer-identity constraints); used via Sigstore public-good TUF, self-hosted TUF mirror, or static trusted-root file
open-source project covered by Patch the Planet week one
Legitimate code-signing infrastructure abused by the malware to request signing certificates from Fulcio, create Rekor transparency log entries, and generate SLSA Build Level 3 provenance attestations for malicious npm packages.
Underlying signing infrastructure used by npm provenance attestations (available since npm 9.5)
proves where and how artifacts were built (build provenance), contrasted with cicd-sensor's runtime evidence collection
Legitimate code-signing/transparency infrastructure abused by the payload to forge valid signed provenance for malicious npm packages
Legitimate signing/provenance service; listed as a detection opportunity endpoint since unexpected access may indicate provenance/signing abuse
signing of binaries, with build provenance
used to sign all release artifacts with build provenance attestations
All technologies in this workspace.