Attesting and Verifying Your Software Supply-Chain With In-toto
Talkat KubeCon + CloudNativeCon Europe 2025 · on Wednesday, 2025-04-02· at 17:45· Level 3 | ICC Capital Suite 7-9·
summary
in-toto provides cryptographic attestations for build steps and a layout language that enforces who may run each step; a production-ready toolchain includes in-toto witness (captures inputs/outputs and signs attestations), Archivist (stores and queries attestations) and guac (visualizes artifact dependency graphs). GitHub Actions, Homebrew and PyPI generate provenance; sigstore already contains hundreds of thousands of in-toto attestations. Work-in-progress: an attestation verifier that plugs layouts into policy enforcement and prototypes used for FedRAMP compliance.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:22Software supply chain basics
- 1:42Supply chain security threats
- 6:45Compliance as an enabler
- 8:38Achieving transparency
- 11:57Tooling for attestations
- 14:11Visualization with GUAC
- 16:03Enforcing policies
- 21:33Community and adoption
- 22:49Q&A and concluding remarks
related talks
35mAchieving End-To-End Software Supply Chain Security With in-toto
34mSecuring the Software Supply Chain with in-toto
40mIn-Toto: Protecting Software Supply Chain in Cloud Native and Application in Confid...
45mA Step Closer to in-Toto’lly Secure: Using in-Toto and OPA Gatekeeper...
35mToto-Ally TUF: Simple Tools for a Secure Software Supply Chain
37mUsing TUF and in-toto to Tighten the Release Process.
25mCompletely Securing the Software Supply Chain using Grafeas + in-toto - Lukas Puehringer
20mNot Just Ticking a Box – Establishing Trust in Artifacts with Proven...