Protect your software supply chain with Tekton and Sigstore
summary
Demonstrates a Tekton CI pipeline that builds a container image, captures SLSA v1.0 provenance, and produces an image URL and digest. The pipeline signs metadata first using a KMS key and then with Sigstore Fulcio (keyless), records entries in Rekor or an OCI registry, and uses Tekton Chains to generate signed attestations and verify provenance against the transparency log; the setup achieves SLSA level 2 but not level 3 hardening.
AI-written summary · about
chapters (6)
- 0:00Supply chain security
- 3:11SALSA incremental security
- 13:38Tekton Pipelines basics
- 21:32Sigstore digital signatures
- 28:47Tekton Chains with Sigstore
- 32:20SALSA level 2 compliance
related talks
22mCloud Native Supply Chain Security with Tekton and Sigstore
23mSoftware Supply Chain Integrity with Sigstore
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
33mSLSA FRSCA Recipe For Secure Supply Chain
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE