Toto-Ally TUF: Simple Tools for a Secure Software Supply Chain
summary
Software supply chain compromises rise 742% over three years and the claim is that combining TUF and in-toto gives verifiable end-to-end integrity. The demo builds an example pipeline, publishes layouts and keys to a repository service for TUF, and shows a tampered source with mismatched hash failing verification. Root/layout keys live offline, snapshots/timestamps prevent replay, and tooling (open source) automates distributing attestations and recovering from key compromise.
AI-written summary · about
chapters (24)
- 0:00Software supply chain security
- 1:03Supply chain attacks overview
- 2:08Evidence gathering and policy
- 4:59TUF principles for resilience
- 9:57TUF and in-toto together
- 11:42Demo setup
- 13:27Supply chain layout with in-toto
- 14:54Workflow and artifact upload
- 15:56Client verification
- 17:25Tampering detection
- 18:27Tampering attempts detection
- 19:53Demo recap and security summary
- 20:56TUF benefits for metadata
- 21:37Call to action and open source
- 23:41Q&A
- 24:03TUF and SBOMs relationship
- 26:18TUF securing infrastructure
- 28:23SBOMs purpose
- 29:28Commit signing and workflows
- 30:48TUF against phishing
- 31:52TUF beyond software
- 32:34Getting involved in TUF
- 33:38Securing non-software artifacts
- 34:10Closing remarks
related talks
29mTUF-en up Your Software Supply Chain
37mUsing TUF and in-toto to Tighten the Release Process.
32mState of the Art Supply Chain Security
40mIn-Toto: Protecting Software Supply Chain in Cloud Native and Application in Confid...
35mAchieving End-To-End Software Supply Chain Security With in-toto
41mUsing TUF to Mitigate Repository Compromises
33mAttesting and Verifying Your Software Supply-Chain With In-toto
34mWhen the Going Gets Tough, Get TUF Going! [I]