3 ms·
I'm hoping Rekor can become a place these "attestations" live for open source software artifacts, allowing us to trace all of this stuff back across build syste
by dlor 5y ago
I'm hoping Rekor can become a place these "attestations" live for open source software artifacts, allowing us to trace all of this stuff back across build systems and environments. We have a long way to go, but it's moving very fast!
I'm a maintainer of Rekor and the other Sigstore projects.
- Foxboron 5y agoI'm still not sold on the idea of having something bound by OIDC identities with Google/RedHat as stakeholders. Looking at the general conversation about FOSS developer identity that has been happening on OpenSSF, what are the actual chances of people with anonymous identities to be allowed commits on the tree in the future?
- dlor 5y agoI understand the concern around anonymous identities and want to make sure it's always possible to use them. OIDC is really just the protocol, you don't even actually need to use email address-based tokens if you don't want to. We actually already support SPIFFE and machine-based identity tokens as well.