tldr - powered by Generative AI

• Attestation data provides proof of an event and allows tracing of outputs from inputs in the software delivery pipeline.
• Verification process is necessary to ensure integrity and authenticity of the attestation data.
• Integrity ensures that the attestation data cannot be tampered with, while authenticity ensures identification of the attestation creator.
• Non-forigibility and non-perishability ensure that the attestation content cannot be influenced by users operating the pipeline.
• Complete zero trust in the system is necessary to establish trust in the attestation data.

tldr - powered by Generative AI

• Salsa sets standards for build system execution to ensure trustworthiness
• Threat modeling for build system on Kubernetes identifies additional threats and ways to mitigate them
• Tecton can do more to verify image provenance and address volume isolation
• Spire can be used to catch tampering with Tecton CRDs
• Trusted resources in Tecton ensure execution of intended tasks and pipelines

tldr - powered by Generative AI

• Tecton users have direct access to objects and metadata fields, making it difficult to lock down Providence metadata fields
• Kubernetes cluster classes are managed by different entities, making it challenging to restrict access to metadata fields
• The Task Run object becomes a main attack point for malicious actors
• The proposed solution involves creating a trusted computing base and restricting access to metadata fields
• Spiffy Inspire provides strong attestation and verification for the trusted computing base
• Future work includes extending the solution to other custom resources and validating artifacts passed between tasks

tldr - powered by Generative AI

• Salsa is an emerging standard that puts many requirements on the table for supply chain security implementation
• Compliance-driven implementation of the framework may result in minimal value and negotiation with suppliers is necessary
• Provenance documents can be built from APIs and log files to avoid opening up all pipelines
• Level three of Salsa promises better protection from developer workstations and adjacent build systems
• Strongly authenticated actors and retention of sources indefinitely are challenging requirements to comply with
• The Salsa standard provides solutions but they are hard to implement and may result in loss of accreditation

tldr - powered by Generative AI

• Understanding the order of steps in supply chain management is crucial to effectively addressing problems
• Prioritizing solutions based on the problem at hand is more effective than blindly implementing solutions
• The speaker shares an anecdote about the challenges of vulnerability scanning and the importance of building a vulnerability management system
• The speaker emphasizes the importance of having an S-bomb as the foundation of supply chain management

tldr - powered by Generative AI

• Recent compromises of Codecov and Solar Winds have put a spotlight on software supply chain attacks.
• Lessons that Shopify has learned in protecting millions of businesses and demonstrate these techniques using open source software.
• Traditional defensive techniques can be applied in the cloud.
• Voucher and grafeas implementations can give you control over the software that runs in your clusters.
• The SLSA framework can guide you toward establishing trust in your software.
• Falco can be used to detect malicious behaviour or indicators that your supply chain has been compromised.
• Specific techniques for mitigating supply chain attacks include scanning or reviewing the code, using static analysis, and looking at the reputation and response to previous incidents of the maintainers.
• We can expect more from our suppliers by asking for receipts, an S-bomb, and what your software is made of.

tldr - powered by Generative AI

• SLSA is a framework used to quantify the security of supply chains
• Sixdoor is a project used for signing and verification
• SLSA and Sigstore are brought together to achieve higher security levels in Tecton and Github workflows
• Demos are provided for each platform