The Telemetry of Trust, Using Attestations to Secure Your SDLC...
summary
Autodesk uses cryptographically signed attestations to tell a verifiable story for each build, generating multiple statements per run (they demo six attestation types: environment, SBOM, commit metadata, materials, command result, product) and storing them in a central graph. They instrument legacy Jenkins pipelines with witness, package attestations using the in-toto format, and persist/query them in an Arista graph store to evaluate centralized policies, gate deployments, and enable back‑testing and ML on thousands of builds.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:04Supply chain security state
- 3:13Security at scale challenges
- 5:45Trust telemetry analogy
- 10:19Attestations and their role
- 13:06Generating trusted attestations
- 17:39Attestation generation demo
- 22:49Next steps for attestations
- 27:26Policy evaluation benefits
- 30:13Q&A on SBOM formats
related talks
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
20mNot Just Ticking a Box – Establishing Trust in Artifacts with Proven...
28mIn-toto Attestations for What Really Happens in Your Build Pipelin...
22mRethinking Risk, Governance, and Compliance Applying Automation
23mBee-Lieve in the Metadata: Pollenating Build Attestations on Kubernetes with...
33mAttesting and Verifying Your Software Supply-Chain With In-toto
46mEnhancing Artifact Security with GitHub’s Build Provenance...
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments