Learn about Witness, an open-source modular framework for supply chain security, in this 23-minute conference talk. Explore how Witness creates collections of attestations bound to the CI process, providing trusted sectors for policy enforcement. Discover the Witness trust model and its integration with cloud-native security tools like rekor, spire, cosign, and Kubernetes. Gain insights into SLSA Level 4 providence requirements, signer support, cryptographic document support, and policy verification. Examine use cases such as ensuring builds on approved infrastructure, verifying SAST testing, and handling upstream build system compromises. Watch a demonstration of implementing SLSA 3 for a major project using SPIRE.
Securing the Supply Chain with Witness - A Framework for Supply Chain Security
CNCF [Cloud Native Computing Foundation] via YouTube
Overview
Syllabus
Thank you to our Session Recording Sponsor
Witness Introduction
SLSA Level 4 - Providence Reqs
Witness' Trust Model
Signer Support
Cryptographic Document Support
Policy Verification
Use Case: Ensure all builds happened on approved infra
Use Case: Verify an artifact passed SAST testing
Use Case: IR - Upstream Build System Compromise
DEMO: SLSA 3 for a major project - SPIRE
Taught by
CNCF [Cloud Native Computing Foundation]
