Sponsored BoF: Baking a Cake with Supply Chain Tooling
summary
A working demo builds a Docker image with GitHub Actions + cosign, generates SLSA provenance JSON, attaches that attestation to Rekor, and uses a kyverno policy to enforce that images from a given namespace are signed by a specific GitHub identity. The end-to-end recipe mostly works; policy controller was broken during the demo, so kyverno is used instead. Repository includes reusable workflows and a git-sign path for commit attestation to link source, build, and artifact.
AI-written summary · about
chapters (8)
- 0:00Baking with supply chain tooling
- 1:04Supply chain security tooling
- 3:56GitHub workflows and signed builds
- 8:45Policy enforcement challenges
- 11:38Git-sign and identity verification
- 15:40SLSA provenance and attestations
- 23:06Trusting GitHub and OIDC
- 35:27Final thoughts and Q&A
related talks
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
39mKicking Security Chain Attacks to the Curb with Kyverno and Notary...
54mFrom "Trust Me" to "Verify Me"
28mBuilding Images for the Secure Supply Chain
33mSLSA FRSCA Recipe For Secure Supply Chain
02h 59mCI/CD with Github Actions
46mEnhancing Artifact Security with GitHub’s Build Provenance...