---
id: 1738
title: "We sign code now"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2022/11/08/sigstore-code-signing-verification-software-supply-chain/"
published_at: "2022-11-08T12:30:15Z"
tags: ["supply-chain", "open-source", "cryptography", "code-signing"]
phying_url: "https://phying.com/item/1738"
lang: en
---

# We sign code now

## Summary

Trail of Bits on Sigstore's general availability: how the Linux Foundation project's Fulcio root CA and Rekor transparency log enable short-lived, identity-based code signing, and the team's contributions to the ecosystem.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2022-11-08T12:30:15Z
- **Original:** https://blog.trailofbits.com/2022/11/08/sigstore-code-signing-verification-software-supply-chain/
- **Phying News:** https://phying.com/item/1738