Security on

What is the Chainguard Factory?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: So Dustin, can you explain what the Chainguard Factory is?

Set up and use Octo STS

Fri, 02 Oct 2026 13:51:55 +0000

Octo STS is a GitHub App that exchanges OIDC tokens from your workloads for short-lived GitHub tokens, so your automation doesn’t need personal access tokens (PATs). This page shows you how to install Octo STS, write trust policies, exchange tokens, and fix failed exchanges. For background on why Octo STS exists, read Octo STS: Short-lived GitHub tokens without PATs in Supply Chain Security 101.

How the token exchange works

Octo STS issues tokens according to trust policies that you keep in your repositories:

Guardener Commit Verification

Wed, 08 Jul 2026 00:00:00 +0000

The Commit Verification feature verifies that every commit in a pull request is cryptographically signed by an authorized signer, according to a policy you control. This ensures that changes to your codebase come from identities you trust, and it supports both keyless (Sigstore) signatures and static keys such as GPG.

Keyless commit signatures are verified using gitsign and Sigstore. Static key authorities (such as GPG) are verified directly against the key material you supply, without gitsign.