Securing the Supply Chain with Witness
summary
Witness is an open source framework that implements in-toto and bundles CI-produced attestations into signed collections using DSSE and short-lived certificates (Fulcio/Workload SPIRE), then stores attestations in Rekor for timestamped nonrepudiation. It verifies GCP, AWS and GitLab JWTs, enforces OPA-style policies (example: require Snyk score < 510), and runs file/process traces of build commands to capture digests. Demo verifies a spire agent build on project 3243222, rejects wrong-credential commits, and enforces Kubernetes admission with those policies.
AI-written summary · about
chapters (6)
- 0:00Introduction to witness
- 1:07Attestation framework design
- 3:29Establishing cryptographic trust
- 7:38Policy engine and enforcement
- 10:32Security use cases
- 13:55Demonstration and conclusion
related talks
20mSecuring the Software Supply Chain with the in-toto & SPIRE projects
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
15mEnforcing a Secure Supply Chain on Kubernetes
22mCloud Native Supply Chain Security with Tekton and Sigstore
40mEnforcing a Secure Supply Chain on Kubernetes
33mSLSA FRSCA Recipe For Secure Supply Chain
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub