Enhancing Validation Through Attestations
summary
Demonstrates using intoto 3.0 to generate chained attestations (build → internal → release) for a Rust binary (cargo build, Cargo clippy, package.tar) and shows tamper detection when a package checksum changes. Highlights practical limits: signatures use OpenSSL PEM keys, verify skips byproducts not validated and return-code checks by default, and inspect defaults to 10s. Recommends multi-layout chaining, disallowing wildcards for leaked paths, and keeping private keys offline.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:51Software attestations
- 6:22Tools and terminology
- 8:09Layouts and components
- 9:34Usage of attestations
- 14:57Multi-layout validation
- 17:45Simple attestation layout
- 21:01Live demo setup
- 24:12Building attestations
- 26:59Chaining attestations
- 31:37Q&A
- 35:57Use cases and verification
- 39:52Q&A and closing
related talks
33mAttesting and Verifying Your Software Supply-Chain With In-toto
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments
54mFrom "Trust Me" to "Verify Me"
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
59mLayered Attestation of a Cross-Domain System
45mA Step Closer to in-Toto’lly Secure: Using in-Toto and OPA Gatekeeper...
28mIn-toto Attestations for What Really Happens in Your Build Pipelin...
33mGrowing the Chain: Trusting Build Provenance from Userspace