Securing Your Container Native Supply Chain with SLSA, Github and Te...
summary
Demonstrates concrete steps to get provenance and signatures into container builds: SLSA Level 2 via Tekton + Tekton Chains by extracting artifacts from TaskRuns, building with Kaniko, and storing in an OCI registry; signatures and in-toto-formatted provenance are created and verifiable. Shows keyless signing using cosign + Fulcio + Rekor (Sigstore) so service accounts get short‑lived certs. Also shows SLSA Level 3 with GitHub Actions and trusted builder using OIDC-issued builder identities and reproducible verification.
AI-written summary · about
chapters (15)
- 0:00Start
- 2:19What is SLSA?
- 3:56SLSA Framework
- 4:33SLSA Level 2
- 6:37Sigstore eliminates the key management problem
- 7:45Sigstore provides code-signing certs mapped to an identity
- 8:49People and systems can request Fulcio certificates People can sign in with an email address
- 10:11Tekton Tasks
- 11:21Tekton Chains: Supply Chain Security for Tekton
- 19:57GitHub Workflow example
- 21:02SLSA 3 Requirements
- 22:19Builder isolation?
- 23:31Signature generation
- 24:18Web PKI Vs SLSA PKI
- 25:02How to verify provenance
related talks
36mSpicing up Container Image Security with SLSA & GUAC
34mProtect your software supply chain with Tekton and Sigstore
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
33mGrowing the Chain: Trusting Build Provenance from Userspace
40mSLSA with Us: The Dance of AppSec
33mSLSA FRSCA Recipe For Secure Supply Chain
22mCloud Native Supply Chain Security with Tekton and Sigstore
54mFrom "Trust Me" to "Verify Me"