Platform Driven Compliance with Sigstore at Autodesk
summary
Autodesk integrates Cosign + in-toto into Jenkins CI to sign images and emit structured attestations stored in an OCI registry attestations model, then enforces deployment decisions in Spinnaker via Rego/OPA image policy that blocks out‑of‑policy images. Teams migrating to the Cloud OS platform report a 35% control reduction in FedRAMP responsibilities; Autodesk tracks 284 vendor/cloud controls versus 62 product‑team controls and aims for continuous monthly auditing for FedRAMP Moderate. Machine identity with SPIRE and keyless signing is planned next.
AI-written summary · about
chapters (8)
- 0:00Autodesk and developer needs
- 2:11FedRAMP compliance overview
- 3:55Reducing compliance burden
- 4:52Supply chain threat vectors
- 8:12Implementing trust telemetry
- 11:13CI/CD security architecture
- 13:54Tooling and policy automation
- 16:53Future work and Q&A
related talks
16mAutodesk’s journey to FedRAMP compliance
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
38mThe Telemetry of Trust, Using Attestations to Secure Your SDLC...
36mWhere Does Your Software (Really) Come from?
33mAutomating Industry Regulation (SoX, SoC 2) Enforcement...
32mReimagining Trust in Software Releases: A New Approach to Supply Chain Integrity (Part 2)
33mCompliance as Code - Lessons Learned From Regulated Organizations