State of the Art Supply Chain Security
summary
Claim: a transparent, compromise‑resilient supply chain is practical today. Implementation stitches in-toto, TUF, and SigStore (cosign/fulcio/rekor) into CI/CD that signs Python wheels with YubiKey hardware keys, publishes TUF metadata, and records attestations in a Rekor log. Datadog runs this since 2018 with 3000-version history of verified metadata; a live demo pulls signed TUF metadata, finds the Rekor entry, and matches the downloaded hash, proving the system works end‑to‑end.
AI-written summary · about
chapters (6)
related talks
35mToto-Ally TUF: Simple Tools for a Secure Software Supply Chain
35mAchieving End-To-End Software Supply Chain Security With in-toto
29mTUF-en up Your Software Supply Chain
01h 27mSupply Chain Security Tooling
23mSoftware Supply Chain Integrity with Sigstore
40mEnforcing a Secure Supply Chain on Kubernetes
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
36mKubernetes Supply Chain Security: The Software Factory