Uncovering the History of Your Software Artifacts
summary
Archivist indexes In-Toto attestations into a graph-backed store and exposes a GraphQL API so policies can find real provenance instead of guessing. A demo uses Witness to sign build and packaging attestations for a Go binary (SHA-256 hash), stores them in Archivist, then queries by artifact hash to retrieve a build attestation, six related envelopes and a visualization showing three different builds, commits and dependencies — enabling automated policy enforcement based on concrete evidence.
AI-written summary · about
chapters (6)
- 0:00Supply chain security issues
- 1:23The discovery and usage gap
- 2:43Graph-based evidence model
- 4:44Introducing archivist
- 6:11Demos and practical application
- 12:44Future goals and conclusion
related talks
20mNot Just Ticking a Box – Establishing Trust in Artifacts with Proven...
45mA Step Closer to in-Toto’lly Secure: Using in-Toto and OPA Gatekeeper...
33mAttesting and Verifying Your Software Supply-Chain With In-toto
46mEnhancing Artifact Security with GitHub’s Build Provenance...
36mWhere Does Your Software (Really) Come from?
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
28mIdentity-based Trust - Till Death Do We Part?
38mThe Telemetry of Trust, Using Attestations to Secure Your SDLC...