From Pipelines To Provenance: Reproducible Builds With Tekton
summary
Two independent Tekton pipeline runs first produce different container SHAs, then after concrete fixes produce the same SHA (E59): pin the base image by digest, set SOURCE_DATE_EPOCH=0, pass Buildah flags to zero timestamps, and build Go with -trimpath and -buildid= to remove nondeterminism. The demo builds a simple Go HTTP image with Tekton pipelines, uses Buildah to build, and Tekton Chains plus Cosign to emit Tekton Chains + Cosign SLSA provenance proving byte-identical image digests; hermetic execution remains experimental.
AI-written summary · about
chapters (16)
- 0:00Reproducible builds intro
- 1:45Why builds matter now
- 3:10Real attacks on builds
- 4:32Security benefits
- 6:58Five reproducibility challenges
- 10:29Achieving reproducible builds
- 12:37Tekton as build platform
- 16:57Live demo setup
- 18:23Fixing non-deterministic builds
- 21:55Dockerfile for determinism
- 24:10Pipeline flags for reproducibility
- 25:14Hermetic execution in Tekton
- 26:37From pipelines to provenance
- 27:59Tekton Chains SLSA provenance
- 31:31Language-agnostic tips
- 32:14Key takeaways
related talks
34mProtect your software supply chain with Tekton and Sigstore
19mWho Are You Building For: Pipelines Have a Purpose
18mLet Devs Be Devs Without Sacrificing Security
34mFrom Code to Deployment: A Deep Dive into Pipelines as Code
16mOperating Tekton with Secure Defaults
20mDevSecOps with Shipwright and Tekton
30mTekton Chains in Action
29mCloud Native CD Pipelines with Tekton