Mitigating attack on Software Supply Chain using GOSH Docker Extension
summary
Claims that GOSH prevents August 3-style supply‑chain strikes by using a content-addressable blockchain with per‑commit cryptographic signatures, immutable consensus timestamps, and a Docker extension that builds and signs images from commit to container; demo shows a protected main branch requiring DAO votes (two members holding 200 tokens total, majority needed), an image build+sign flow that validates successfully, and a formal‑verification path for CI/CD via partner Pruvendo and formally verified CI/CD tooling.
AI-written summary · about
chapters (8)
- 0:00GOSH and supply chain attacks
- 3:57Container verification with GOSH
- 7:30Demo: satellite upgrade flow
- 16:19Immutable blockchain logs
- 19:53Formal verification of smart contracts
- 27:03Verifying CI/CD scripts
- 35:10Provable container builds future
- 36:57Closing remarks and Q&A
related talks
37mSecuring OSS across the whole supply chain and beyond
38mSecuring the chains: Building defensive layers for software supply chains
35mAchieving End-To-End Software Supply Chain Security With in-toto
36mSecure your software supply chain from dependencies to deployment
40mPractical guides for enhacing your Software Supply Chain Security
45mCloud, Containers & Security
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
37mUntrusted Execution: Attacking the Cloud Native Supply Chain