State of the Art Supply Chain Security - In-toto, TUF, and SigStore

Explore the state-of-the-art supply chain security in this 32-minute conference talk from CNCF's KubeCon + CloudNativeCon Europe 2022. Delve into the complementary roles of TUF, in-toto, and SigStore in creating a transparent, hack-proof software supply chain that prevents man-in-the-middle attacks between developers and end-users. Learn about Datadog's pioneering implementation of in-toto and TUF for secure updates, and discover how SigStore's transparent and auditable model enhances publisher accountability. Witness a real-world demonstration of the entire security stack in action through Datadog's integration, and gain insights on easy adoption strategies. The presentation covers key topics including the problem at hand, Six Store, software supply chain intricacies, a practical demo, and a comprehensive security analysis.