From 7365ec188d4facdaee40d22f1f755eab1c4b5636 Mon Sep 17 00:00:00 2001 From: Hector Fernandez Date: Fri, 15 Jul 2022 14:02:34 +0200 Subject: [PATCH 1/3] chore: add policy-controller ref (#34) Signed-off-by: hectorj2f Signed-off-by: Ivan Wallis --- VMware/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/VMware/README.md b/VMware/README.md index 5ba41fe..a62c4b4 100644 --- a/VMware/README.md +++ b/VMware/README.md @@ -1,5 +1,5 @@ * [VMware](https://www.vmware.com/) is an enthusiastic participant in the sigstore community. As a leading provider of enterprise Kubernetes software through the [Tanzu](https://tanzu.vmware.com/) portfolio, we look to sigstore as an important set of tools for helping our customers better secure the software supply chain for modern applications. * R&D staff are working on Tanzu solutions using Cosign, and we are spearheading Cosign integration into [kpack](https://github.com/pivotal/kpack), [Carvel](https://carvel.dev/), and [Harbor](https://goharbor.io/). -* [VMware Tanzu Application Platform](https://tanzu.vmware.com/application-platform) is a modular, application-aware platform that provides a rich set of developer tooling and a prepaved path to production. We are utilizing cosign from sigstore as our signing tool for developers. Cosign helps to provide an irrefutable proof of the integrity and authenticity of the produced artefacts. +* [VMware Tanzu Application Platform](https://tanzu.vmware.com/application-platform) is a modular, application-aware platform that provides a rich set of developer tooling and a prepaved path to production. We are utilizing cosign as our signing tool for developers, and policyt-controller from sigstore as our validation tool for the platform. Cosign helps to provide an irrefutable proof of the integrity and authenticity of the produced artefacts. -Copyright 2021 VMware, Inc. +Copyright 2022 VMware, Inc. From 224a930319bb0c2a4bc3ab2cb01d3439def6195c Mon Sep 17 00:00:00 2001 From: Ivan Wallis Date: Fri, 27 Jan 2023 11:32:17 -0800 Subject: [PATCH 2/3] venafi-jetstack info Signed-off-by: Ivan Wallis --- Venafi/README.md | 9 +++++++++ jetstack/README.md | 9 +++++++++ 2 files changed, 18 insertions(+) create mode 100644 Venafi/README.md create mode 100644 jetstack/README.md diff --git a/Venafi/README.md b/Venafi/README.md new file mode 100644 index 0000000..91d1e10 --- /dev/null +++ b/Venafi/README.md @@ -0,0 +1,9 @@ +# Venafi, Inc. + +[Venafi](https://www.venafi.com) is the leader in machine identity management. + +[Venafi CodeSign Protect](https://venafi.com/codesign-protect/) integrates with sigstore/cosign via PKCS#11 to provide strong controls over the enterprise code signing keys and certificates, used to sign container images. + +Venafi also uses sigstore/cosign to sign its internally developed container images. + + diff --git a/jetstack/README.md b/jetstack/README.md new file mode 100644 index 0000000..51c85f6 --- /dev/null +++ b/jetstack/README.md @@ -0,0 +1,9 @@ +# Jetstack Ltd. + +[Jetstack](https://jetstack.io) helps businesses to build and operate modern cloud native infrastructure with Kubernetes. + +Jetstack also designed and maintains the [cert-manager](https://github.com/cert-manager/cert-manager) open source project – the de facto cloud native solution for developers to automate TLS and mTLS certificate issuance and renewal + +* Jetstack is an active user of the sigstore project +* We use sigstore/cosign to sign our open source container images along with [SLSA provenance](https://slsa.dev/provenance/v0.2) and a [CycloneDX SBOM](https://cyclonedx.org/). +* ??? \ No newline at end of file From 67408d0d5d35f72431947944d2a3610517b4796e Mon Sep 17 00:00:00 2001 From: Ivan Wallis Date: Tue, 7 Feb 2023 13:43:34 -0800 Subject: [PATCH 3/3] consolidated jetstack and venafi Signed-off-by: Ivan Wallis --- Venafi/README.md | 7 ++++++- jetstack/README.md | 9 --------- 2 files changed, 6 insertions(+), 10 deletions(-) delete mode 100644 jetstack/README.md diff --git a/Venafi/README.md b/Venafi/README.md index 91d1e10..9f7a3ba 100644 --- a/Venafi/README.md +++ b/Venafi/README.md @@ -2,8 +2,13 @@ [Venafi](https://www.venafi.com) is the leader in machine identity management. -[Venafi CodeSign Protect](https://venafi.com/codesign-protect/) integrates with sigstore/cosign via PKCS#11 to provide strong controls over the enterprise code signing keys and certificates, used to sign container images. +[Venafi CodeSign Protect](https://venafi.com/codesign-protect/) integrates with sigstore/cosign via PKCS#11 to provide strong controls over the enterprise code signing keys and certificates, used to sign container images and other artifacts such as SBOMs. Venafi also uses sigstore/cosign to sign its internally developed container images. +[Jetstack](https://jetstack.io), a Venafi company, helps businesses to build and operate modern cloud native infrastructure with Kubernetes. +Jetstack also designed and maintains the CNCF [cert-manager](https://github.com/cert-manager/cert-manager) project – the de facto cloud native solution for developers to automate TLS and mTLS certificate issuance and renewal. + +* Jetstack is an active user of the sigstore project +* We use sigstore/cosign to sign our open source container images along with [SLSA provenance](https://slsa.dev/provenance/v0.2) and a [CycloneDX SBOM](https://cyclonedx.org/). diff --git a/jetstack/README.md b/jetstack/README.md deleted file mode 100644 index 51c85f6..0000000 --- a/jetstack/README.md +++ /dev/null @@ -1,9 +0,0 @@ -# Jetstack Ltd. - -[Jetstack](https://jetstack.io) helps businesses to build and operate modern cloud native infrastructure with Kubernetes. - -Jetstack also designed and maintains the [cert-manager](https://github.com/cert-manager/cert-manager) open source project – the de facto cloud native solution for developers to automate TLS and mTLS certificate issuance and renewal - -* Jetstack is an active user of the sigstore project -* We use sigstore/cosign to sign our open source container images along with [SLSA provenance](https://slsa.dev/provenance/v0.2) and a [CycloneDX SBOM](https://cyclonedx.org/). -* ??? \ No newline at end of file