TUF-en up Your Software Supply Chain
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 11:45· Platinum Suite | Level 3 | Room 1-2·
summary
Explains how TUF prevents replay and tampering by layering metadata (root.json, snapshot, timestamp) and multi‑sig root keys and shows a live flow: ingest image and SBOM/attestations into a TUF repo, sign with pipeline and human keys, serve artifacts from S3/PVC or OCI, and verify before Kubernetes deploys. Demo uses TUF with in‑toto attestations, Helm charts and TUF client libraries (Go/Python/Rust), updates NGINX v1.25.5, deletes a signed version and proves deployments stop honoring removed metadata.
AI-written summary · about
chapters (6)
- 0:00TUF and supply chains
- 1:46Secure distribution challenges
- 5:22What is TUF
- 10:10TUF in supply chains
- 13:23TUF in practice
- 19:40Q&A
related talks
35mToto-Ally TUF: Simple Tools for a Secure Software Supply Chain
34mWhen the Going Gets Tough, Get TUF Going! [I]
22mSecuring Content Repositories with the Update Framework (TUF)
26mTUF-En Up Your Signatures
41mWhen The Going Gets Tough, Get TUF Going!
36mTUF / Notary Project Intro
39mIntro: TUF / Notary
37mUsing TUF and in-toto to Tighten the Release Process.