Who's Verifying Your Signatures? Approaching Private Container Image Signing - Ethan Lowman, Datadog
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2022-10-28

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io​. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Who's Verifying Your Signatures? Approaching Private Container Image Signing - Ethan Lowman, Datadog

By some estimates, the rate of software supply chain security attacks has more than doubled in recent years, leading to renewed demand for software integrity defenses, especially for popular open source projects. In response to this demand, healthy competition has emerged between signing technologies like Sigstore and Notary v2 to set a new standard for secure delivery of open source container images. But how do these technologies fare when applied to private container image signing? While building integrity controls for their internal Kubernetes software supply chain, Datadog's security team has found that signing and verifying images internally is subtly different than in an open source setting. This talk will compare the unique challenges of signing container images internally versus in open source, and discuss how the leading open source signing frameworks meet those challenges at scale.