Not Just Ticking a Box – Establishing Trust in Artifacts with Proven...
summary
Compares concrete provenance outputs from GitHub Actions, Witness, and Tekton: GitHub Actions produces only repo+commit only metadata and exposes signing keys to the build, Witness records file accesses and digests but also leaves keys reachable, while Tekton/Conflux produces task-level attestations and keeps signing material not available to build. Uses cosign for attestations, generates SBOMs, evaluates artifacts with OPA/Rego policies to gate production, and reports that policy gating reduces shadow pipelines and speeds safe releases.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:02What is provenance
- 3:32Software signing limits
- 4:37Attestations better
- 6:25Provenance in attestations
- 7:49GitHub Actions limits
- 8:30Witness tool provenance
- 9:12Conflux platform provenance
- 9:54Task-level provenance
- 10:58Provenance practical uses
- 12:46Policy-driven provenance
- 14:11Reducing shadow pipelines
- 15:57Democratizing contributions
- 17:00Q&A
- 18:28Provenance adoption challenges
related talks
54mFrom "Trust Me" to "Verify Me"
46mEnhancing Artifact Security with GitHub’s Build Provenance...
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
36mWhere Does Your Software (Really) Come from?
33mGrowing the Chain: Trusting Build Provenance from Userspace- 33mGrowing the Chain: Trusting Build Provenance from Userspace
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
33mAttesting and Verifying Your Software Supply-Chain With In-toto