Verifiable GitHub Actions with eBPF - Jose Donizetti & Itay Shakury, Aqua Security
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2023-02-02

Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Verifiable GitHub Actions with eBPF - Jose Donizetti & Itay Shakury, Aqua Security

GitHub actions have been one of the most popular ways to build and release software, with recent developments in supply chain security it became a major target for malicious attacks. A couple of years ago a widespread hack to codecov, a popular service prevalent in build pipelines, caught the industry’s attention. In response, a new solution to protect the build pipeline was created on top of Tracee, OSS Runtime Security solution, and introduced the concept of profiling with eBPF and verifying software builds. In this talk we will present that solution and explore the lessons learned in the past two years since the initial release.