Sign, Attest, and Verify! A Practical Guide for Software Supply...
summary
Explains how OCI referrers API (OCI v1.1) attaches SBOMs and scan reports to immutable image digests, and how signing and verification prevent tampered metadata; shows Notary using x509 keypairs and cosign offering keyed and keyless signatures plus transparency logs. Demonstrates Kyverno image verification policies that enforce signature/attestation checks at admission, with caching in the admission controller; demos block a pod when a vulnerability attestation is older than 730 hours and allow it after raising the threshold to 7,300 hours.
AI-written summary · about
chapters (11)
- 0:00Securing software supply chains
- 1:04Container images basics
- 6:00Vulnerabilities and SBOMs
- 8:46Signing container images matters
- 10:33Cosign and Notary tools
- 12:22Kerno security enforcement
- 15:10Cosign with Kerno demo
- 17:57Keyless signatures demo
- 20:47Notary signatures demo
- 22:32Attestation policies demo
- 26:57Q&A
related talks
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments
37mNotary: State Of Development
31mSigned, Sealed, Delivered - Sign and Verify All the Things
39mKicking Security Chain Attacks to the Curb with Kyverno and Notary...
15mEnforcing a Secure Supply Chain on Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes
40mNotary v2: Deep Dive and Open Issues
35mEnforcing a Secure Supply Chain on Kubernetes