Completely Securing the Software Supply Chain using Grafeas + in-toto - Lukas Puehringer
summary
Concrete workflow: a machine-verified project layout and link metadata defines every build, test and package step, with each step’s artifacts signed by specific keys; Grafeas ingests structured records like notes and occurrences (build provenance, vulnerabilities, images) and an external verifier runs in-toto against those records and produces an attestation pushed back to Grafeas. Demos include Debian/Arch integration, reproducible-build evidence, a Postgres-backed Grafeas prototype in production use, and an admission-controller example that blocks deployments without attestations.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:49A Stylized Software Supply Chain
- 1:33Attackers Can Hack The Software Supply Chain
- 2:21Many Good Point Solutions
- 3:53Gaps Between Steps? Compliance?
related talks
33mAttesting and Verifying Your Software Supply-Chain With In-toto
35mAchieving End-To-End Software Supply Chain Security With in-toto
34mSecuring the Software Supply Chain with in-toto
20mSecuring the Software Supply Chain with the in-toto & SPIRE projects
24mProtecting Ourselves from CNCFgate. Software Supply Cha...
23mMastering Secure Software Supply Chains
35mToto-Ally TUF: Simple Tools for a Secure Software Supply Chain
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...