Zero Trust Supply Chains with Project Sigstore and SPIFFE
summary
Describes a concrete zero‑trust pipeline: CI builds an image, Cosign requests a short‑lived certificate from Fulcio after an OIDC check, Rekor records the signature in a transparency log, and a Kubernetes policy controller verifies the signature and SPIFFE identity before allowing deployment. Uses keyless signatures, transparency log (Rekor) and Spire workload attestation to tie artifacts to attested runtime identities. Demo failed live and is converted into a step‑by‑step tutorial.
AI-written summary · about
chapters (8)
- 0:00Introduction and speakers
- 3:18Software supply chain risks
- 5:14The need for zero trust
- 8:04Spiffy and Spire overview
- 10:41Spire architecture
- 13:05Project Sigstore basics
- 16:17Sigstore and Spiffy integration
- 20:34Q&A and closing
related talks
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
23mSoftware Supply Chain Integrity with Sigstore
15mEnforcing a Secure Supply Chain on Kubernetes
35mEnforcing a Secure Supply Chain on Kubernetes
22mCloud Native Supply Chain Security with Tekton and Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
40mEnforcing a Secure Supply Chain on Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes