Growing the Chain: Trusting Build Provenance from Userspace
summary
Explains how to trust build provenance produced in user-controllable CI by linking artifact metadata to CI configuration and build systems, using Sigstore OIDC short-lived certs to issue ephemeral keys and bind identity, and combining user-space SLSA/COSIGN-style attestations with system-space attestations from tools like Tekton Chains or SLSA GitHub action generators. Shows Chainguard images and examples with npm, Cosign, Goreleaser, describes tradeoffs, reproducible-build checks (matching inputs/outputs, Source State Epoch) and when verification fails.
AI-written summary · about
chapters (20)
- 0:00Providence and supply chain security
- 1:05What makes software trustworthy
- 3:11Defining Providence and attestations
- 5:16Trusting CI-generated Providence
- 5:57Identity in Providence verification
- 8:45Trustworthy identity providers
- 9:29Verifying Providence correctness
- 12:19User and system space Providence
- 13:43SLSA GitHub Actions example
- 15:23Tekton Chains example
- 16:46Trust boundaries and security
- 18:31Trust for open source and private use
- 19:53Enforcing Providence checks in Kubernetes
- 21:01Q&A: SLSA levels and reproducible builds
- 23:54Q&A: Cross-verifying builds
- 26:27Q&A: Reproducibility in Providence
- 28:39Q&A: Dates in reproducible builds
- 30:26Q&A: Reproducible build tools
- 31:09Q&A: Securing source code
- 32:12Q&A: Signing Git commits
related talks
33mGrowing the Chain: Trusting Build Provenance from Userspace
54mFrom "Trust Me" to "Verify Me"
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
46mEnhancing Artifact Security with GitHub’s Build Provenance...- 46mEnhancing Artifact Security with GitHub’s Build Provenance...
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub