Securing the Software Supply Chain with in-toto
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 10:55· Room 23BC - San Diego Convention Center, Upper Level·
summary
in-toto provides an explicit supply-chain model that declares steps, participants and accepted inputs then records what actually happens using layout and link metadata so deploys are verifiable at admission time. integrations include a lightweight Jenkins plugin (stores signed stamps to Redis/etcd), a Kubernetes admission controller and simple 50-line Go hooks for scanners like kube‑sec. three implementations exist (Python is most mature), production users include Datadog and Microsoft, and the system proves provenance recursively across dependencies.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:10Securing the Software Supply Chain with in-toto
- 2:02How is software shipped?
- 5:30Attackers can hack the software supply chain
- 7:12Gaps between steps? Compliance?
- 7:57We want to secure the complete software supply chain!
- 14:46Using the Jenkins plugin
- 15:24Deployment benefits
- 17:00Maintenance
- 20:43How you can help
- 28:50Thank You! Questions?
related talks
35mAchieving End-To-End Software Supply Chain Security With in-toto
40mIn-Toto: Protecting Software Supply Chain in Cloud Native and Application in Confid...
33mAttesting and Verifying Your Software Supply-Chain With In-toto
32mSoftware Supply Chain Security
35mToto-Ally TUF: Simple Tools for a Secure Software Supply Chain
20mSecuring the Software Supply Chain with the in-toto & SPIRE projects
36mKubernetes Supply Chain Security: The Software Factory
21mSecuring the IaC Supply Chain