Verifiable eBPF Traces for Supply Chain Artifacts with Witness and Tetragon
summary
Integration of Witness with Cillium Tetragon captures eBPF traces of build processes to produce signed attestations and a bill of materials; ptrace is synchronous but slows builds ~6x, while eBPF is asynchronous, requires root, sometimes misses hashes but records network calls. A red‑team injector emulates a SolarWinds compromise, changes main.go, and the system detects the hash change. A signed policy engine enforces and blocks workloads compiled by a malicious compiler with a deny decision.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:47Verifiable eBPF traces for attestations
- 5:00Witness and its role
- 8:34Current tracing with P Trace
- 10:01eBPF tracing with Tetragon
- 13:57Demo setup and tampering
- 17:37Demo results and policy enforcement
- 19:16Mitigating compromised compilers
- 21:00Demo two and policy signing
- 24:12CI integration with GitLab
- 25:54Q&A
related talks
28mIn-toto Attestations for What Really Happens in Your Build Pipelin...
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
36mSecuring CI/CD Systems Through eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
36mSecuring the Superpowers: Who Loaded That EBPF Program?
43meBPF Superpowers for SRE
40mVerifiable GitHub Actions with eBPF
29meBPF on the Rise - Getting Started