Thread by @richburroughs

I’m excited to see @puerco talking about securing the Kubernetes software supply chain. Yay SIG Release :) #KubeCon

LOL at @puerco’s fake TED talk beginning, I was howling 😂

OMG this is so funny 😂

So @puerco started off with some hysterical examples of software supply chain solutions, based on Star Wars. Now he’s covering how they build and release artifacts for k8s. #KubeCon

They added SBOMs a while ago. Then they started signing images at the staging point of the process. The problem with that is an attacker could compromise things and sign a bad artifact. #KubeCon

Then they promote the artifacts and they verify the image signatures in that process. They sign them again before they are copied to the production registry. So you can see they were built by the release team (1st sig), and released by the Kubernetes project (2nd sig). #KubeCon

Diagram of the release process. #KubeCon

One last step after that picture: they copy things to the production bucket, including the SBOMs and attestations. #KubeCon

Seriously, thank you to @puerco and everyone else on SIG Release who is working to secure the Kubernetes supply chain. As Adolfo mentioned, they have a small team and it’s a lot of work. They would love to have more help too :) #KubeCon

Also I know some of the folks working on this are @chainguard_dev employees and I appreciate the company donating the time to do this important upstream work. Thank you Chainguard :) #KubeCon

Good question about sigstore. @puerco explained that they “keyless” signing is done with ephemeral keys, and the public keys are stored in the transparency log. #KubeCon