Notary v2: Redesigning the Secure Supply Chain for Containers
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Wednesday, 2020-11-18· at 16:55· Intrado Virtual Event Platform,·
summary
Notary v2 claims to make container signing registry-native by storing OCI artifact signatures as separate JWT objects that reference image digests, not by mutating manifests, and prototypes show a Docker plugin that runs docker notary sign, pushes image plus signature to a test registry (nv2.azurewebsites.net), and successfully pulls and validates when the public key is present. Key design changes include detached signatures, a proposed registry reverse lookup API to traverse signatures back to artifacts, and work on key management and policy integration.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:36Who are we?
- 2:03Supply Chain Security
- 4:35The Update Framework
- 5:49Notary history
- 7:32Key issues to fix
- 16:49Notary v2 Scenarios
- 19:41Signatures in registry
- 28:36Meta-data services
- 30:34Next steps
related talks
30mNotary v2: Supply Chain Security for Containers
40mNotary v2: Deep Dive and Open Issues
35mNotary: State of the Container Supply Chain
36mRedesigning Notary in a Multi-registry World
37mNotary: State Of Development
33mIntroduction to Notary
29mNotary Project: The Key To Secure Software Supply Chain
06mNotary Project: Securing Binary Artifacts with Fine-grained Control