Notary: State of the Container Supply Chain
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 16:30· Concourse Hall 153 ABC + Online·
summary
Notary v2 decouples identity from location so cryptographic signatures travel with images rather than staying tied to a registry, using the notation client and the auras OCI library to attach signed SBOMs, scan results and multiple signatures as detachable artifacts. The workflow supports offline v‑net promotion by copying referenced graphs into private registries, integrates KMS keys and planned revocation, and ships a draft spec and working prototype showing end‑to‑end promotion and verification across registries.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:01State of the Container Supply Chain
- 3:22Stages of the Supply Chain
- 8:09Attesting To Entity Promotion
- 11:17Artifact Promotion
- 16:27Location Independence
- 17:30Supply Chain Artifact Challenges
- 25:03Promoting Artifacts
- 31:16Notary v2 Policy Management
related talks
30mNotary v2: Supply Chain Security for Containers
32mNotary v2: Redesigning the Secure Supply Chain for Containers
37mNotary: State Of Development
40mNotary v2: Deep Dive and Open Issues
36mRedesigning Notary in a Multi-registry World
29mNotary Project: The Key To Secure Software Supply Chain
33mIntroduction to Notary
31mSign, Attest, and Verify! A Practical Guide for Software Supply...