Redesigning Notary in a Multi-registry World
Talkat KubeCon + CloudNativeCon North America 2019 · on Wednesday, 2019-11-20· at 16:25· Room 6E - San Diego Convention Center, Upper Level·
summary
Notary 2.0 redesign proposes storing signature objects in the registry next to blobs so signatures travel with images, using detached signatures that sign content hashes (avoiding fragile canonical JSON), and converting many per-repo root keys into sane hierarchical delegations so collections and mirrors validate together. Work targets TUF-backed metadata mapped into OCI registries, fixes manifest-list vs manifest digest confusion (v2 schema), and acknowledges Docker Hub and Azure run Notary but most registries don’t yet; code-first experiments and a CNFC notary-v2 channel are starting the rollout.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:38Open Source Community
- 1:06Supply Chain Security
- 2:14Tough Notary
- 6:21Registry
- 13:05Detached signatures
- 16:37Collections of things
- 23:02Other pieces
- 27:22Questions
related talks
32mNotary v2: Redesigning the Secure Supply Chain for Containers
40mNotary v2: Deep Dive and Open Issues
30mNotary v2: Supply Chain Security for Containers
37mNotary: State Of Development
35mNotary: State of the Container Supply Chain
18mBeyond signatures: Using TUF and Notary to Secure Software Distribution
41mDeep Dive: TUF / Notary
29mNotary Project: The Key To Secure Software Supply Chain