Notary v2: Supply Chain Security for Containers
summary
Notary v2 stores signatures and metadata as registry-native OCI artifacts and links them to images with a reference-based reverse lookup so signatures, SBOMs and other documents travel and delete with the image. Prototype tooling includes an NV2 Docker plugin and oras discovery APIs that show the graph. Pulls verify signatures before downloading to prevent trojan pulls. The design adds X.509 support and cloud/HSM key management and aims for a usable signing release in H2 2021.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:22Why secure supply chains
- 3:40Standardization and trust
- 5:48Notary v1 lessons and v2
- 8:20Challenges in v1
- 10:10Requirements for v2
- 12:22Future plans
- 14:54Artifact graph design
- 18:14Demonstration
- 29:22Conclusion and resources
related talks
32mNotary v2: Redesigning the Secure Supply Chain for Containers
35mNotary: State of the Container Supply Chain
40mNotary v2: Deep Dive and Open Issues
37mNotary: State Of Development
29mNotary Project: The Key To Secure Software Supply Chain
36mRedesigning Notary in a Multi-registry World
33mIntroduction to Notary
06mNotary Project: Securing Binary Artifacts with Fine-grained Control