The Chain of Command: Building Trust Across Public Sector Software Pipelines
Talkat Open Source Summit Europe 2025 · on Monday, 2025-08-25· at 15:35· Elicium 2A (Elicium Level 1)·
summary
Public sector lacks a shared root of trust and often runs airgapped or nonpublic infrastructure, so the group produces a reference architecture and white paper that tie concrete tools together: sigstore (cosign, fulcio, rekor) for signing and transparency, SBOM + OpenVEX + in-toto for provenance and vulnerability applicability, witness/archavista/sbombit and bombctl for generating and aggregating metadata, Git Tough and RS-TUF for repository and identity policy, and Zarf plus SIGstore bundles for offline verification across air gaps. The claim: federated private instances plus policy-driven promotion let small suppliers meet procurement requirements without breaking automation.
AI-written summary · about
chapters (8)
- 0:00Supply chain security intro
- 3:31Software supply chain attacks
- 12:05Reference architecture
- 23:03Public sector challenges
- 27:38Building trust in pipelines
- 31:52Secure build and distribution
- 37:14Consuming and verifying software
- 41:04Next steps and resources
related talks
24mSecuring Software Supply Chains for the Public Good
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
30mSecuring Open Source Supply Chains
23mMastering Secure Software Supply Chains
32mSoftware Supply Chain Security
29mState of the secure software supply chain
33mGrowing the Chain: Trusting Build Provenance from Userspace- 33mGrowing the Chain: Trusting Build Provenance from Userspace