---
# System prepended metadata

title: SigstoreCon CFPs

---

# SigstoreCon CFPs

## Proposal 1

### Title 

WYSIWYG: What you sign is what you get

### Abstract

One of the crucial parts of securing the Software Supply Chain is ensuring the authenticity of the software. We have thousands of options to distribute our software, and every option comes with its own risk. We primarily use public container registries to store and distribute container images with others! But... Should we really do it? Based on the zero-trust principle, we should trust nothing but verify everything. We can't ensure whether it is compromised.

Software Supply Chain integrity ensures a component is what it says it is, and provenance is about knowing where a particular part came from. To be convinced that your software and its provenance haven't been changed when you deploy your software, you must cryptographically sign them before allowing it to deploy on production.

REMEMBER! "What you sign is what you get."

### Benefits to the Ecosystem

There are so many things happening in this area. SBOMs, Signing/Verification, Transparency Logs, Ephemeral Certificates, OMG!! Even larger companies are focused on how to make their software supply chains even more secure with a bunch of great open-source projects because once they see the potential of these they immediately want to discover these opportunities. In this talk, we'll help them by giving an overview of all these tools first, then, explaining how they can use them for what with detailed demos.

Don't forget that increasing your security also means increasing the security of your users, which also means increasing the trust between us.

## Proposal 2

### Title 