Accepting a Release Only from Its Trusted Publisher is a practical DevSecOps project for learners who know basic terminal and file operations. Build a receiver for Waymark's walking festival guide: accept the requested publisher-signed update, publish its actual verified bytes, and keep the existing visitor functions working.
Two Guided Labs introduce the trust decisions and receiver step by step. An independent Challenge applies the same tools to an accessible guide, where a genuine signature can still belong to the wrong product.
What You Will Learn
After completing this course, you will be able to:
- distinguish an adjacent checksum from an independently trusted approval;
- verify a real Cosign signature using a pinned publisher public key;
- check the requested product, version and archive digest as separate decisions;
- write a short Bash receiver that stops on failure and passes the verified copied archive to a prepared publisher;
- refuse unapproved deliveries while preserving previous releases, visitor pages and the real route download.
Who This Course Is For
This course suits beginning DevSecOps learners, developers and operators who want a small, complete software-delivery task.
Prerequisites: Basic terminal navigation and familiarity with small text files. The course explains signatures, digests and the required shell syntax before use; Python programming is not required.
Learning environment: A prepared Linux environment with Cosign, supplier parcels, a separate trusted key/request, and the working Waymark website. Use Workspace for commands and Event Guide for the actual pages and downloads.
Frequently Asked Questions
Do I need a cloud account or my own signing key?
No. The lab provides synthetic signed deliveries and an independently pinned public key. The publisher's private key is not supplied to learners.
Is this a complete public Sigstore identity-verification workflow?
No. This project uses offline, self-managed key signatures and explicitly skips public transparency-log verification. It does not verify public OIDC identities or claim a SLSA level.
What will I finish with?
A reusable receiver and a working updated guide with matching route-sheet bytes. The Challenge combines the taught decisions independently; it introduces no new signing mechanism.
