Sign, Attest, and Verify! A Practical Guide for Software Supply...-Anushka Mittal & Vishal Choudhary
Channel: CNCF [Cloud Native Computing Foundation]
Date: 18/12/2023

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon Europe in Paris from March 19-22, 2024. Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

Sign, Attest, and Verify! A Practical Guide for Software Supply Chain Security - Anushka Mittal & Vishal Choudhary, Nirmata

After prominent attacks like SolarWinds and Log4J, the OSS community has risen to address related concerns such as ensuring image integrity, security, & compliance at scale. Supply chain security initiatives include signing container images & artifacts. The referrers API support in OCI v1.1 Spec makes it easy to associate software supply chain artifacts with container images in content distribution. The Notary Project provides cross-industry standards for securing software supply chains through signing & verification, signature portability, & key/certificate management. It enables CNCF policy engines like Kyverno to consume the supply chain artifact's data & apply security checks at the time of admission control in Kubernetes clusters. Let's explore how CNCF projects like Kyverno & Notary can enhance software supply chain security. Let's see how Notary can enforce image trust & how Kyverno prevents untrusted image deployment, ensuring image integrity, security, & compliance at scale.