Signing and verifying: checksums, keys, cosign and Sigstore

55 min Node.js 22 (Debian, git, npm, python3)

Objective

Learn to prove that what you deploy is exactly what was built, and by whom it was built. You will handle the basic building blocks (SHA-256 checksums, ECDSA signature with OpenSSL), then see how cosign and Sigstore apply them to container images, up to "keyless" signing from CI.

This lesson is part of the full course

Unlock DevSecOps: Securing Code, Dependencies and Containers to read every lesson, do the exercises, access the simulations and earn your certificate.

Buy — 290 MAD All-access pass — 1,490 MAD

Already enrolled? Log in.