Spicing up Container Image Security with SLSA & GUAC
summary
Shows how to add SLSA provenance to container images and cryptographically verify them using Sigstore tools (Fulcio/Rekor/cosign) with GitHub Actions and Google Cloud Build, proving provenance linkage to a specific repo and workflow. Demonstrates reusable-workflow isolation between builder and build, a keyless signing flow that mints short‑lived certs, and a SLSA GitHub generator plus SLSA verifier that fail when source repo or tag mismatch. Uses SBOM ingestion and a GUAC graph (Neo4j) to map attestations, builders, dependencies, and deployment-time policy checks via Kyverno and sigstore policy-controller.
AI-written summary · about
chapters (7)
- 0:00Container image security intro
- 1:01Supply chain security matters
- 7:46Software attestations
- 14:49SLSA with GitHub Actions
- 20:07Provenance for container images
- 25:28Discovering artifacts with GUAC
- 31:27Closing & resources
related talks
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
40mSLSA with Us: The Dance of AppSec
46mEnhancing Artifact Security with GitHub’s Build Provenance...
36mEnforcing a Secure Supply Chain on Kubernetes
34mProtect your software supply chain with Tekton and Sigstore
33mGrowing the Chain: Trusting Build Provenance from Userspace