Proving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
summary
Demonstrates a reproducible, SLSA-aligned pipeline that produces signed images and attestations, uses cosign/SignServer to attach SLSA provenance, and anchors signing in hardware (YubiKey) so keys cannot be exfiltrated. Argo CD + Kyverno enforce admission: unsigned or provenance-missing images are rejected, while GitLab CI pushes digested images to Docker Hub and updates manifests. Shows real attack classes—tag replacement, pipeline injection (SolarWinds style), malicious maintainer—and proves automatic attestation at deploy time with hardware-backed keys preventing silent compromise.
AI-written summary · about
chapters (8)
- 0:00Trust in software supply chains
- 1:07SLSA for Kubernetes
- 3:11Where trust breaks down
- 5:59Implicit trust in deployments
- 7:43Trust challenges at the edge
- 9:06Verifiable deployments demo
- 18:36Trust to cryptographic proof
- 19:41Q&A
related talks
54mFrom "Trust Me" to "Verify Me"
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
35mPractical Guides for Enhancing Your Software Supply Chain Security
35mEnforcing a Secure Supply Chain on Kubernetes
33mSLSA FRSCA Recipe For Secure Supply Chain
33mGrowing the Chain: Trusting Build Provenance from Userspace
28mBuilding Images for the Secure Supply Chain