From 501f84f2f0ebf81e7ae6b0104210c558e314da16 Mon Sep 17 00:00:00 2001 From: jonvnadelberg <121979961+jonvnadelberg@users.noreply.github.com> Date: Wed, 18 Oct 2023 19:23:49 -0700 Subject: [PATCH] Update overview.md (#263) * Update overview.md change verify to associates in one instance for consistency. Signed-off-by: jonvnadelberg <121979961+jonvnadelberg@users.noreply.github.com> * Update overview.md remove typo error Signed-off-by: jonvnadelberg <121979961+jonvnadelberg@users.noreply.github.com> * Update overview.md Signed-off-by: jonvnadelberg <121979961+jonvnadelberg@users.noreply.github.com> --------- Signed-off-by: jonvnadelberg <121979961+jonvnadelberg@users.noreply.github.com> --- content/en/about/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/about/overview.md b/content/en/about/overview.md index b89b1f83..d1da7c12 100644 --- a/content/en/about/overview.md +++ b/content/en/about/overview.md @@ -42,7 +42,7 @@ Sigstore addresses these problems by helping users move away from a key-based si The signer ideally forgoes using long-lived keypairs. With “keyless” or “ephemeral key” signing, users verify the artifact using the transparency log for signature verification rather than keys. Sigstore improves on traditional methods of signing to be more convenient and secure: - **Convenience**: Users can take advantage of convenient tooling, easy container signing, and can even bypass the difficult problem of key management and rotation. -- **Security**: With Sigstore, the artifact is not just signed; it’s signed, verified, and witnessed. +- **Security**: With Sigstore, the artifact is not just signed; it’s signed with an ephemeral key, associated with a known identity, and publicly auditable. ## How Sigstore works