Road to SLSA3: Non-falsifiable Provenance in Tekton with SPIFFE/SPIRE

on YouTube ↗38m

" summary

Build pipeline Tekton integrates SPIFFE/SPIRE and Tekton Chains to reach SLSA level 3 by making provenance non-falsifiable: each taskrun pod receives an SVID signing key via SPIRE, task containers sign results, the Tekton controller signs status, and Chains verifies signatures and trust bundles before emitting attestations. Demo shows the system accepts valid runs and rejects a live-modified taskrun (image changed) so no attestation is produced, proving the approach detects tampering.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 8:09Example Object
3. 13:12Tekton & SLSA Level 3 with SPIRE Architecture
4. 15:35Tekton & SLSA Level 3 Flow

" related talks

• 22mCloud Native Supply Chain Security with Tekton and SigstoreChristie Wilson, Priya Wadhwa · SupplyChainSecurityCon North America 2021
• 33mSLSA FRSCA Recipe For Secure Supply ChainMichael Lieberman, Parth Patel · KubeCon + CloudNativeCon North America 2022
• 20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...Michael Lieberman · Cloud Native SecurityCon Europe 2022
• 34mProtect your software supply chain with Tekton and SigstoreGiovanni Galloro · devsecopsday 2023
• 50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFEDan Lorenc · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 37mLeveraging Cryptographic Lineage for Context and ConnectedTrustYogi Porla · CloudNativeSecurityCon North America 2024
• 32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...Laurent Simon, Priya Wadhwa · KubeCon + CloudNativeCon Europe 2022
• 33mGrowing the Chain: Trusting Build Provenance from UserspaceBilly Lynch · Open Source Summit Europe 2023