Policy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
summary
Argues that cryptographic signing plus automated policy can verify an entire software supply chain from upstream commits to production, showing a working stack: sigstore (certificate authority, Rekor log, cosign), keyless signing via OIDC, Tekton Chains for CI signing, OPA/Gatekeeper for policy checks, and Keylime for TPM-based host attestations. Notes Kubernetes has ~1,000 upstream dependencies, describes signatures recorded in an append-only log, and demonstrates build-time and deploy-time verification and automated acceptance or rejection.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:58Kubernetes dependencies
- 1:32Software supply chains
- 2:32Softwar overview
- 3:38Open source
- 5:06Software signing
- 11:55Software Policy
- 16:56Software Verification
- 22:54Overview
related talks
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
23mSoftware Supply Chain Integrity with Sigstore
40mSigstore: How We Started, Where We Are, Where We are Headed
36mSigstore: Past, Present and Future Directions
36mEnforcing a Secure Supply Chain on Kubernetes
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno