PGP vs. sigstore: A Recap of the Match at Maven Central

At Sonatype, a great presentation never dies. Nor does it simply fade away. While you might watch a presentation given by one of our team members onsite or online for a developer conference or community event, you can also catch a faithful adaptation in written form on our blog. This is one such case. Hervé Boutemy delivered this presentation at Devoxx Belgium in October 2022, and we’ve sought to replicate his words and je ne sais quoi below.

Step into the code-signing ring

Ladies and gentlemen, welcome to today’s main event! 

The venue is Devoxx Belgium. In one corner, we have PGP— the veteran code-signing tool that’s been a mainstay in the industry for decades. In the other corner, we have sigstore— the new kid on the block, making waves with its innovative approach to code signing. This match is sure to be a showdown of epic proportions, as we pit these two contenders against each other to see who comes out on top. 

Who will emerge victorious? Will PGP’s years of experience give it the edge it needs to defend its title as champion? Or will sigstore’s fresh perspective and holistic approach secure a win in this major match? 

Let’s find out, as we bring you the highly anticipated PGP vs. sigstore match at Maven Central!

What brought us here

To identify and remediate security issues in open source software, a good place to start would be to determine where the software came from and how it was built.

One method to see if a piece of software you use is what it claims to be: check it for a cryptographic digital signature to verify the identity of the author or build system. 

While there need not be a competition between code-signing tools, (Read more...)