From "Trust Me" to "Verify Me"
summary
Build pipelines produce signed provenance and attestations with concrete steps: generate digest-based signatures using cosign, mint short-lived certs via Fukio and record them in Rekor, attach provenance and SBOMs as OCI referers, and publish ORAS-packaged non-container artifacts. GitHub Actions can emit SLSA level 3 provenance but NuGet alters package digests and attackers can still exfiltrate signing keys (the Megalodon incidents), so enforce verification gates with OPA/Gatekeeper before deployment.
AI-written summary · about
chapters (11)
- 0:00The supply chain threat
- 2:40The need for verification
- 5:57Artifact signing methods
- 9:02Implementing signing tools
- 17:25Advanced attack vectors
- 22:15Understanding SLSA framework
- 28:10Build provenance and claims
- 34:02OCI and ORAS implementation
- 39:21Consumer verification and risks
- 44:26Automating security gates
- 51:19Conclusion and future outlook
related talks
20mNot Just Ticking a Box – Establishing Trust in Artifacts with Proven...
33mGrowing the Chain: Trusting Build Provenance from Userspace- 33mGrowing the Chain: Trusting Build Provenance from Userspace
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
46mEnhancing Artifact Security with GitHub’s Build Provenance...
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...