A Step Closer to in-Toto’lly Secure: Using in-Toto and OPA Gatekeeper...
summary
Demonstrates an end-to-end pipeline that generates signed attestations for each CI step with in-toto tooling, captures commands via Witness, stores and indexes attestations in Archivista, and enforces verification in Kubernetes using an OPA Gatekeeper external data provider. The demo builds and tars a multi-arch image, detects a typo‑squatted GitHub Action that injected an “you just got pwned” command, fails witness verify, and causes Gatekeeper to reject the deployment — proving the enforcement path works.
AI-written summary · about
chapters (11)
- 0:00in-Toto and supply chain security
- 2:08Supply chain security for builds
- 5:45Attestations and their role
- 7:27What is in-Toto
- 8:30in-Toto layouts and enforcement
- 12:24Storing attestations efficiently
- 17:23Demo: Typo-squatting attack
- 24:50Witness for GitHub Actions
- 30:09Gatekeeper and Arista in Kubernetes
- 34:25Enforcing policy with witness and Rego
- 35:10Q&A
related talks
33mAttesting and Verifying Your Software Supply-Chain With In-toto
54mFrom "Trust Me" to "Verify Me"
37mUsing TUF and in-toto to Tighten the Release Process.
35mAchieving End-To-End Software Supply Chain Security With in-toto
20mNot Just Ticking a Box – Establishing Trust in Artifacts with Proven...
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments
23mSecuring the Supply Chain with Witness
15mUncovering the History of Your Software Artifacts