Zero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
summary
Argues that supply-chain trust shifts from registries to verifiable provenance and demonstrates it end-to-end: TektonCD and GitHub Actions produce images whose build metadata and commit signatures are recorded in Sigstore’s transparency log and validated via SPIFFE/Spire-originated workload credentials and GitHub OIDC. Shows tracing an image back to the exact git commit and action run, contrasts that with an unprovable Prometheus chart, cites Snyk’s ~650% increase in supply-chain attacks, and highlights signed provenance and reproducible builds as practical defenses.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:05Zero Trust Supply Chain Security
- 3:26Treat Your Build System like a Production Environment
- 5:43Dependency Confusion
- 8:06A 650 Percent Increase in Supply Chain Related Attacks in 2021
- 10:13Perimeter Based Defenses
- 11:02What Is Zero Trust
- 15:44Don'ts
- 23:12Identity
- 23:34Spiffy
- 28:01Sigstor Project
- 38:34Base Image Annotation
- 39:23Reproducible Builds
- 45:39Do You Need To Make any Changes to the Tool Chains You Used To Build
related talks
31mZero Trust Supply Chains with Project Sigstore and SPIFFE
34mProtect your software supply chain with Tekton and Sigstore
22mCloud Native Supply Chain Security with Tekton and Sigstore
33mGrowing the Chain: Trusting Build Provenance from Userspace
35mAchieving End-To-End Software Supply Chain Security With in-toto
27mSecuring your Software Supply Chain on Kubernetes with Sigstore- 33mGrowing the Chain: Trusting Build Provenance from Userspace
36mEnforcing a Secure Supply Chain on Kubernetes