Growing the Chain: Trusting Build Provenance from Userspace
Talkat Open Source Summit Europe 2023 · on Thursday, 2023-09-21· at 15:55· Room 0E-1 (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Shows how to link an artifact to CI config and the runner by using Sigstore + OIDC to mint short‑lived keys and sign provenance, and by applying SLSA levels to grade build transparency. Gives concrete builds: Chainguard secure images signed with Sigstore, a GitHub Actions generator that emits SLSA provenance, and Tekton Chains that observes pipelines and signs build metadata. Demonstrates verification via Kubernetes admission checks, notes remaining trust‑boundary limits and the need for reproducible inputs.
AI-written summary · about
chapters (20)
- 0:00Providence and supply chain security
- 1:05What makes software trustworthy
- 3:11Defining Providence and attestations
- 5:16Trusting CI-generated Providence
- 5:57Identity in Providence verification
- 8:45Trustworthy identity providers
- 9:29Verifying Providence correctness
- 12:19User and system space Providence
- 13:43SLSA GitHub Actions example
- 15:23Tekton Chains example
- 16:46Trust boundaries and security
- 18:31Trust for open source and private use
- 19:53Enforcing Providence checks in Kubernetes
- 21:01Q&A: SLSA levels and reproducible builds
- 23:54Q&A: Cross-verifying builds
- 26:27Q&A: Reproducibility in Providence
- 28:39Q&A: Dates in reproducible builds
- 30:26Q&A: Reproducible build tools
- 31:09Q&A: Securing source code
- 32:12Q&A: Signing Git commits
related talks
33mGrowing the Chain: Trusting Build Provenance from Userspace
54mFrom "Trust Me" to "Verify Me"
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
40mSLSA with Us: The Dance of AppSec
46mEnhancing Artifact Security with GitHub’s Build Provenance...
36mSpicing up Container Image Security with SLSA & GUAC