Enhancing Artifact Security with GitHub’s Build Provenance...
summary
Demonstrates using GitHub’s Build Provenance API to emit SLSA attestations and Sigstore-backed signatures (Fulcio issues 10-minute certs, cosign-compatible ephemeral key signing) and stores content-addressable attestations alongside images or in GitHub’s attestation store. Verification runs in GH CLI or Sigstore policy controller; attestations include build provenance fields (repo, workflow, ref, runner) usable for precise allowlists. Minder ingests those attestations to create Minder policy enforcement profiles that detect compromised build workflows or registry hijacks and can auto-remediate drift.
AI-written summary · about
chapters (19)
- 0:00Artifact security with GitHub
- 1:14GitHub artifact attestations
- 3:20Signing versus attestations
- 5:48Open source foundations
- 7:54Signing in GitHub Actions
- 9:37Ephemeral keyless signing benefits
- 12:31Sigstore public vs private
- 15:16Why build provenance matters
- 16:39Attestations in workflows
- 18:45Verify with CLI and Cosign
- 20:11Security beyond signing
- 21:35Demo workflow overview
- 23:57Verify artifacts with CLI
- 27:42Minder introduction
- 29:12Minder features
- 33:05Supply chain threats demo
- 35:51Setup Minder enforcement
- 39:22Custom Minder profile
- 44:52Strengthen security with Minder
related talks
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
54mFrom "Trust Me" to "Verify Me"
33mGrowing the Chain: Trusting Build Provenance from Userspace
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
34mProtect your software supply chain with Tekton and Sigstore
35mAchieving End-To-End Software Supply Chain Security With in-toto
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments
23mBuilding Secure Package Pipelines