Achieving End-To-End Software Supply Chain Security With in-toto
summary
Claims that in-toto provides end-to-end provenance that ties Git commits, PR reviews, tags, builds and OCI images into verifiable artifacts; implementations exist in Python, Go, Java, Rust and extensions I4/I6/I7 add GitBOM/SPDX/CycloneDX attestations and x509 identity. Demos use Tekton/Jenkins/GitLab runners, Sigstore/tuf transparency logs and a Keylime Supply Chain Bridge that forwards verified binary hashes to hardware attestation. The demo builds an artifact, publishes signatures and provenance, and successfully detects tampering when a modified binary yields a mismatched hash.
AI-written summary · about
chapters (8)
- 0:00in-toto and supply chain security
- 3:32Modeling supply chains with in-toto
- 7:25in-toto policy enforcement demo
- 12:05in-toto implementations state and future
- 17:45Supply chain tools with Keylime
- 21:15Supply Chain Bridge demo with Keylime
- 28:06Future work and integrations
- 30:13Q&A
related talks
33mAttesting and Verifying Your Software Supply-Chain With In-toto
34mSecuring the Software Supply Chain with in-toto
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
44mSecuring the Supply Chain for Your Java Applications
32mState of the Art Supply Chain Security
23mMastering Secure Software Supply Chains
34mProtect your software supply chain with Tekton and Sigstore
20mSecuring the Software Supply Chain with the in-toto & SPIRE projects