Securing the Software Supply Chain with the in-toto & SPIRE projects
summary
Shows an implemented pipeline that combines in-toto and SPIRE to move from signature-only trust to evidence-based trust: SPIRE issues workload X.509 identities (even tied to a TPM public key) and those certs sign in-toto step metadata. A layout-driven build enforces materials/products, automated verification rejects an injected change in the demo, and metadata travels with artifacts so consumers can cryptographically verify origin and build machine. automated certificate issuance reproducible verification
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:12The problem at hand
- 3:55Zero Trust Architecture
- 6:22CICD Pipeline
- 7:35Evidencebased Trust
- 10:00How does it work
- 11:05What is SPIRE
- 12:04How SPIRE works
- 13:31Demo
related talks
35mAchieving End-To-End Software Supply Chain Security With in-toto
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
29mState of the secure software supply chain
32mA Platform-Agnostic Approach to Securing Workloads
34mSecuring the Software Supply Chain with in-toto
31mZero Trust Supply Chains with Project Sigstore and SPIFFE
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
23mSecuring the Supply Chain with Witness