Securing the Software Supply Chain with the in-toto & SPIRE projects - Cole Kennedy & Mikhail Swift
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2021-05-14

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Securing the Software Supply Chain with the in-toto and SPIRE projects - Cole Kennedy & Mikhail Swift BoxBoat Technologies

A software supply chain is the set of steps required to test, build, deploy, and assure a software release. Verification of the build policy through a cryptographically attestable process is required to give software artifact consumers the confidence to install software releases on mission-critical systems. In this talk, we will discuss the current gaps in the open-source eco-systems and demonstrate a cryptographically attestable software pipeline with automated certificate issuance.