Builds You (and Others) Can Trust: Meet the AMPEL Policy Engine
summary
Ampel is an open source policy engine that embeds into CI/CD or a CLI, verifies keyless Sigstore verification and in-toto attestations, and evaluates predicate types (SBOMs, SLSA/Salsa attestations, vulnerability scans) against reusable tenets and policy sets. It normalizes SBOMs with SBOM normalization via protobomb, merges OpenVEX suppressions to reduce false positives, collects attestations from GitHub stores and OCI registries, and emits a single combined attestation so builds can be gated or artifacts blocked.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:05Supply chain challenges
- 2:28Software attestations
- 3:35AMPEL policy engine
- 5:00Evaluating attestations
- 6:03Policy structure
- 7:27Transformers and plugins
- 9:56Policy sets and references
- 12:25Running AMPEL locally
- 13:50Demo and resources
- 14:33Q&A
related talks
23mSpice Check: Building an E2E SLSA Implementation
22mRethinking Risk, Governance, and Compliance Applying Automation
23mTrust, Track, and Verify: Securing AI Pipelines End-to-End
22mFrom Mild To Wild: How Hot Can Your SLSA Be?
21mEnforcing Organization Policies with Enterprise Contract
17mVerifiable Build Environments in the Cloud: Powered by Sigstore and Enclaves
43mDear Security, Compliance, and Auditors, We’re Sorry. Love, DevOps.
33mAutomation of SBOM Assessment in AGL Development Process