Notary: State Of Development
summary
Notary v2 moves signatures and attestations into registries using OCI 1.1 and ORAS; images get attached SBoMs and vulnerability scans and are signed with a remote key in Azure Key Vault via the notation CLI using a COSE binary signing format. Docker Hub is piloting artifact support. Verification and enforcement use notation + ratify (local binary or Gatekeeper external-data feed) with a trust store, revocation via OCSP/CRL, and pipeline + admission checks; demos show signing, attestations, and successful cluster admission blocking.
AI-written summary · about
chapters (12)
- 0:00Notary project introduction
- 1:45Origins and early challenges
- 3:08Identity models and key management
- 5:57Transition to COSE formats
- 7:21OCI 1.1 and artifact support
- 9:49Demo: remote signing with Azure Key Vault
- 16:59Compromised identities and trust policies
- 20:07Trust in pipelines and Kubernetes
- 27:13Project status and roadmap
- 27:59SKEW standard future plans
- 29:24Next steps and adoption
- 30:13Q&A
related talks
40mNotary v2: Deep Dive and Open Issues
30mNotary v2: Supply Chain Security for Containers
35mNotary: State of the Container Supply Chain
32mNotary v2: Redesigning the Secure Supply Chain for Containers
06mNotary Project: Securing Binary Artifacts with Fine-grained Control
29mNotary Project: The Key To Secure Software Supply Chain
36mRedesigning Notary in a Multi-registry World
31mSign, Attest, and Verify! A Practical Guide for Software Supply...