~/talk

Using TUF and in-toto to Tighten the Release Process.

on YouTube 37m
Talkat KubeCon + CloudNativeCon North America 2019 · on Wednesday, 2019-11-20· at 10:55· San Diego Ballroom A - Marriott Marquis San Diego Marina Hotel· [security, devops-and-delivery]

speakers

name:Santiago Torres-Arias
website:https://badhomb.re
name:Justin Cappos
links:none on file

resources

video:https://youtu.be/RzxDLrQgEzo
slides:none on file

summary

Describes a concrete pipeline hardening: use TUF to enforce root / targets / snapshot / timestamp roles with separated keys, threshold signing and built-in revocation, and use in-toto to express and verify step-by-step layouts and produce signed evidence links. Cites real integrations — PyPI, Datadog, Notary, automotive Uptane — and a Debian reproducible-build demo where in-toto blocks a malicious mirror, proving the approach works end-to-end rather than just promising examples.

AI-written summary · about

chapters (9)

  1. 0:00Start
  2. 2:28Tls Protection
  3. 7:52Responsibility Separation
  4. 11:33Multi Signature Trust
  5. 13:11Revocation
  6. 14:25Targets
  7. 23:06Xcode Ghost
  8. 29:54Verification Routine
  9. 30:54Builder Organizations

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.