In-toto Attestations for What Really Happens in Your Build Pipelin...
summary
Witness runs the build as a parent process and records processes files network (captures execs, open files, and MITM'd downloads), uses eBPF and ptrace to tap syscalls and transparently proxy TLS traffic, and emits DSSE-wrapped in-toto attestations that convert attestations to SBOM via SBOMit. Demo requires root to load BPF, captures downloaded packages and C headers missing from manifests, generates a verifiable SBOM, and warns that concurrent multi-artifact builds are a known limitation.
AI-written summary · about
chapters (12)
- 0:00In-toto attestations intro
- 1:03Build pipeline transparency
- 3:08SBOM limitations
- 6:00In-toto security gap
- 7:46Attestation structure
- 8:51Provenance tracking
- 9:55Witness in build monitoring
- 11:19Witness tracing details
- 14:29Attestations to SBOMs
- 15:23Witness demo walkthrough
- 23:58Practical limitations
- 25:19Wrap-up resources
related talks
28mSee It to Believe It: Bringing Observability to Otherwise ...
27mVerifiable eBPF Traces for Supply Chain Artifacts with Witness and Tetragon
32mSBOMit: Making SBOMs Accurate With Attestations
33mAttesting and Verifying Your Software Supply-Chain With In-toto
38mThe Telemetry of Trust, Using Attestations to Secure Your SDLC...
41mYour SBOM Is Lying To You – Let’s Make It Honest
32mAsleep at the Wheel: Getting your SBOMs to pay attention...
23mBee-Lieve in the Metadata: Pollenating Build Attestations on Kubernetes with...