Beyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
summary
Supply-chain blind spots get specific fixes: supply chain attacks rise 742% since 2019, recent Trivy compromise hijacks 76 of 77 tags and renames 44 repos, and the gap is missing tamper-evident, queryable records. The demo builds a pipeline that emits custom attestations tied to artifact SHA-256 digests, signs them keyless with witness + cosign + archivist, stores them in Archivist, and enforces OPA gates; verification succeeds for original artifacts and fails immediately after tampering.
AI-written summary · about
chapters (8)
- 0:00Supply chain security intro
- 3:12SBOMs and SLSA limits
- 9:19Why custom attestations
- 13:36Custom attestations workflow
- 16:23Attestation tools
- 17:47Security gaps checklist
- 18:48Live demo: Witness attestation
- 20:54Tamper detection policies
related talks
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
54mFrom "Trust Me" to "Verify Me"
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
23mMastering Secure Software Supply Chains
37mSBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End
33mSLSA FRSCA Recipe For Secure Supply Chain
37mSecuring OSS across the whole supply chain and beyond
37mUntrusted Execution: Attacking the Cloud Native Supply Chain