Open Source Summit Europe 2022

Attestations are rapidly gaining popularity in the software supply chain security community. But most people don’t yet have a practical understanding of how to use them to improve their existing software delivery pipelines, or how they can help you secure your runtime environments. In this talk, Jim will explore how to use Cosign, in-toto attestations, and VEX documents to act as the connective tissue between scanners and policy engines like Kyverno to create secure and auditable runtime environments. He will walk through an end-to-end flow that demonstrates how this system will allow you to react to software security threats and triage them effectively — allowing your teams to focus on critical issues and navigate through the noise and chaos.