Authenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
summary
Demonstrates a practical pipeline for non‑forgeable remote code attestations on GitHub using reusable workflows for isolation and sigstore OIDC keyless signing for authenticity, producing SLSA provenance records. Provides a ready Go implementation — go trusted builder v1 — plus a verifier that successfully checks scorecard v4.4.0 binary + provenance. Claims integrity, authenticity and anti‑interference are solved when using reusable workflows; using GitHub Actions alone is possible but fragile and requires extra server‑side verification and workflow source inspection.
AI-written summary · about
chapters (20)
- 0:00Start
- 1:15Supply Chain Attacks and Compromises
- 2:22Dependency Confusion
- 3:14Code Cub Attack
- 8:14How Can One Trust in Attestation
- 10:10Reusable Workflows
- 10:23Github Workflows
- 11:40How Do We Create a Verifiable Attestation about What Was Run in that Github Workflow
- 11:53Create an Attestation
- 13:49Integrity and Authenticity
- 14:29Github Reusable Workflows
- 20:00Verifying an Attestation
- 21:03Artifact Attestation
- 23:46Creating Policies
- 24:10Policies at Build
- 24:44Github Dependency Api
- 24:55Motivation behind this New Api
- 27:21Demo
- 31:32The Github Actor
- 33:09Problem Statement
related talks
46mEnhancing Artifact Security with GitHub’s Build Provenance...- 46mEnhancing Artifact Security with GitHub’s Build Provenance...
54mFrom "Trust Me" to "Verify Me"
36mWhere Does Your Software (Really) Come from?
20mNot Just Ticking a Box – Establishing Trust in Artifacts with Proven...
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
33mGrowing the Chain: Trusting Build Provenance from Userspace