In-Toto: Protecting Software Supply Chain in Cloud Native and Application in Confid...
Talkat KubeCon + CloudNativeCon + Open Source Summit China 2023 · on Wednesday, 2023-09-27· at 13:55· 3层 301明珠厅| 3F The Pearl Hall 301·
summary
In-toto defines a JSON layout that lists steps, who holds keys, and allowed inputs/outputs, then produces per-step signed links/attestations that prove the build, test, packaging and release sequence actually ran as defined. It limits each functionary’s privileges, supports key rotation, and enables client inspections (for example: verify commits are signed or only approved people merged to main). Used with TPM/TEE measurements it supplies the trusted metadata Confidential Containers needs to validate firmware and system software.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:50Confidential containers
- 6:27Supply chain vulnerabilities
- 13:53Existing solutions
- 17:56In-Toto overview
- 21:47Securing the supply chain
- 27:49Wrap-up and key takeaways
- 31:14Q&A on TPM
related talks
34mSecuring the Software Supply Chain with in-toto
33mAttesting and Verifying Your Software Supply-Chain With In-toto
35mToto-Ally TUF: Simple Tools for a Secure Software Supply Chain
35mAchieving End-To-End Software Supply Chain Security With in-toto
37mUsing TUF and in-toto to Tighten the Release Process.
20mSecuring the Software Supply Chain with the in-toto & SPIRE projects
29mTUF-en up Your Software Supply Chain
34mUntrusted Execution: Attacking the Cloud Native Supply Chain - Francesco Beltramini