►
From YouTube: Achieving End-To-End Software Supply Chain S... Santiago Torres-Arias & Aditya Sirish A Yelgundhalli
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Achieving End-To-End Software Supply Chain Security With in-toto - Santiago Torres-Arias, Purdue University & Aditya Sirish A Yelgundhalli, New York University
in-toto is a CNCF Incubated project that can be used to secure software supply chains. Since joining incubation this year, in-toto has grown in various ways through community contributions. This includes features to perform better artifact tracking (e.g., to include Git, GitBOM, SBOMs and OCI images), as well as extending the base attestation type to include more expressive notions (e.g., SLSA provenance, measured execution, or to sign and attach SBOMs to their corresponding artifacts). Lastly, better integration with CNCF projects for cloud-native identity have been developed through projects such as SPIFFE and Sigstore. In this talk, we will showcase these exciting contributions, and help introduce new members of the audience to ways to particpate, collaborate, and use in-toto to protect their software supply chains. We will showcase in-toto's existing integrations. This will include projects such as Tekton Chains, Jenkins, Gitlab Runners, and rebuiderd (from the reproducible builds project). Finally, the talk will also feature current work on exciting features like Sigstore, SPDX, GitBOM and more!
A
A
So,
let's
talk
a
little
bit
a
little
bit
about
what
we
set
off
to
solve.
Toto
is
pretty
much
focused
in
trying
to
solve
software
supply
chain
attacks.
We
talk
a
lot
about
software
Supply
chains.
Nowadays
we
understand
that
software
is
interconnected
and
that
we
depend
on
other
people's
work
in
other
in
order
to
make
good
software
right
now.
A
software
supply
chain
attack
is
something
that,
even
though
there's
not
a
very
good
definition
out
there,
it's
something
that
we're
constantly
redefining
and
understanding.
A
It's
basically,
the
way
in
which
hackers
try
to
attack
the
left
hand,
side
of
an
equation
say,
like
your
build
system,
your
source
code
repository
any
anything
really
that
produces
software
in
order
to
attack
the
consumers
of
the
software.
Essentially,
the
result
of
your
build
anything.
That's
actually
consequential
to
your
software
delivery
pipeline.
A
Now
this
is
a
slide
that
we
update
every
year,
because
they're
constantly
increasing
I.
Remember
when
I
think,
two
years
ago
we
were
on
a
cumulative
400,
something
percent
increase
in
software
supply
chain
attacks,
and
even
though
we
have
a
lot
of
Technologies
trying
to
solve
this
problem,
they
keep
on
increasing.
We
still
keep
on
seeing
software
supply
chain
attacks
happen.
A
This
is
also
a
slight
that
we
updated
every
year,
unfortunately,
but
this
is
also
something
that,
as
the
internal
project
we've
been
working
on
for
a
while,
which
is
trying
to
catalog
and
understand
how
software
supply
chain
attacks
take
place
and
what
shape
that
they
take.
This
is
a
project
that
we
donated
to
the
cncf
tax
security
group,
I
think
in
2019,
or
so
it's
even
though
it's
not
an
exhaustive
list.
It's
a
very,
very
good
resource
that
talks
about
how
software's
blockchain
attacks
take
place.
How
are
they
actually
carried
out
and
well?
A
We
use
this
ourselves
to
inform
the
design
of
in
Toto
and
in
order
to
essentially
understand
the
Venture
of
a
beast,
to
try
to
tackle
the
problem.
I
really
really
recommend
looking
at
it.
Now
from
this
information,
well,
we
know
that
there's
many
good
solutions
that
came
out
there.
You
may
be
familiar
with
some
of
the
logos
here.
There's
things
such
as
salsa
and
tecton
chains
and
spdx
software
build
materials
in
general.
A
lot
of
people
are
excited
about
projects
like
walk
or
skit,
or
six
door
or
GitHub.
A
All
of
these
things
have
a
place
in
trying
to
tackle
the
software
supply
chain
problem.
On
the
right
hand,
side.
We
also
have
a
say
policy
engines
now,
in
total,
in
and
by
itself,
it's
a
meta
framework,
it's
something
that
allows
you
to
connect
all
of
these
pieces
together
and
actually
develop
a
way
to
verify
software
supply
chain
security
properties,
okay,
go
back
so,
for
example,
here
this
is
probably
a
very
cartoonified
version
of
a
software
supply
chain
right.
We
have
a
version
control
system.
We
have
a
build
system,
so
I'm
living
somewhere.
A
We
have
probably
a
CI
checking
and
running
the
tests.
All
the
time
then
probably
have
some
packaging
infrastructure
we're
putting
a
package
out
there.
Now
all
of
these
things
you
you
do
yourself.
This
is
something
you're
familiar
with
now
being
able
to
connect
all
of
these
things
together
to
write
policy
to
say
well,
I
need
a
version
control
system
with
the
security
properties
in
place
and
in
the
build
system
that
needs
to
behave
in
this
way.
A
I
need
the
packaging
infrastructure
that
needs
to
be
run
by
this
individual
and
it
needs
to
be
behaving
in
this
particular
way.
Well,
that's
something
that
you
can
easily
express
using
Toto
and
the
semantics
of
in
Toto
to
essentially
tell
you
what's
going
on
on
the
other
on
the
other
side,
on
the
left
hand
side
equation
this.
We
also
have
libraries
that
allow
you
to
capture
and
express
the
information
that
you
that
you
collect
during
your
regular
software
supply
chain
operations.
For
example,
you
saw
the
policy
earlier.
A
It
described
what
needed
to
happen
on
this
particular
piece
of
data
that
you
can
collect
using
internal
libraries
or
Integrations
that
we're
going
to
talk
about
in
a
minute.
You
can
start
collecting
these
links
of
the
supply
chain,
these
pieces
of
evidence
that
allow
you
to
verify
the
policy,
for
example,
if
you're
familiar
with
salsa
provenance
at
stations,
that's
an
in
total
predicate,
that's
something
that
you
can
use
to
describe
the
build
system
in
a
very
expressive
way
and
write
policy
around
it
using
total
policies.
A
You
know
using
these
things
collected
together,
then
you
can
essentially
compare
again
think
about
Supply
chains
as
an
equation
right.
What's,
on
the
left
hand,
side,
what's
supposed
to
happen
with
what
actually
happened,
you
take
the
original
layout
of
the
supply
chain
that
you
wrote
using
in
total
and
they
collected
evidence,
and
then
you
contrast
the
two
things
together
to
check
whether
those
things
match
letter
to
letter
right.
A
So
in
order
to
in
order
to
show
the
the
power
of
this,
we
actually
prepared
the
demo
again.
This
is
another
very
cartoonified
version
of
the
software
supply
chain,
but
I
assume
this
is
something
that
you're
doing
probably
every
day
right.
You
have
a
couple
of
colleagues
you
in
this
case
Bob
Alice
and
Carol
they're
working
together
to
make
I,
don't
know
a
new
release,
packaging
in
packaging
package
it
into
a
Docker
container
and
release
it
somewhere
to
eventually
make
it
a
part
of
your
Cloud
infrastructure.
A
In
this
case,
Bob
will
clone
the
repository.
We'll
do
a
couple
of
changes
to
the
code.
Then
it
will
so
he
will
submit
a
pull
request.
It's
going
to
be
reviewed
by
Carol
and
once
Carol
finds
it
appropriate,
she's
going
to
merge
it
and
then
Alice
is
going
to
tag
a
release
and
trigger
a
build
on
a
yeah
on
a
server
to
eventually
make
it
into
a
Docker
container.
A
That
will
eventually
verify
to
make
sure
that
before
we
put
in
the
cloud
it's
correct
I
wanted
to
give
a
shout
out
to
our
two
students
Alan
and
Andrew.
They
actually
did
this
demo
themselves.
I
am
super
impressed
of
all
the
work
they
did.
There's
this
couple
of
months,
should
we
just
Kick,
It
Off,
so
you're
going
to
see
a
lot
of
text
I'm
going
to
try
to
explain
what's
going
on
part
of
a
part
of
what
I
like
about
in
Toto?
A
Is
that
if
everything's
working,
you
really
don't
you're
not
supposed
to
know
as
an
end
user,
but
we're
going
to
make
it
very
verbose.
The
diagram
that
you
saw
just
a
second
ago,
cloning,
changing
changing
some
code,
making
a
PR
and
so
on
and
so
forth,
is
going
to
be
verified.
Every
single
step
is
going
to
create
a
link,
the
little
files
that
we
showed
a
second
ago,
so
that
we
can
actually
build
a
very
granular
provenance
graph.
A
Let's
kick
it
up
so
first,
we
Define
a
demo
layout
which
is
again
this
policy
of
what
needs
to
happen.
We
just
created
it.
It's
on
root,
layout
of
file,
root.air
file.
It's
going
to
be
living
somewhere.
You
can
think
of
this
existing
inside
of,
say,
an
admission
controller
or
something
of
that
nature,
and
now
we're
going
to
actually
kick
start
the
process
of
running
over
our
supply
chain.
We
did
a
git
clone
now
we
are
going
to
make
the
changes.
A
We
will
continue
doing
the
same.
For
example,
in
this
case,
we'll
we'll
track
the
git
commit.
We
change
the
code,
we
track,
what
commit
did
it
take
it
into
so
now
we
know
these
files
are
connected
to
this
commit.
Then
we
track
which
peer
the
pr
didn't
make
it
to
would
say.
Well,
this
commit
made
it
into
this
PR,
which
is
going
to
be
reviewed
by
somebody
and.
A
A
And
now
we
are
yeah.
Now
we're
tagging
a
release.
We
are
going
to
build
a
container
and
we
do
the
exact
same
thing.
We
track
the
the
commit
that
eventually
became
attack,
and
then
we
track
the
tag
that
eventually
became
a
container,
and
we
built
this
paper
trail
of
exactly
what's
going
on
and
where
the
things
come
from.
The
idea
is
that
you
can
create
this
policies
and
this
layouts
to
describe
a
very
granular
level.
A
Now,
when
you
run
the
verification,
which
is
the
last
step,
we
take
all
of
the
evidence
that
we
collected
and
we
compare
it
against
the
layout
that
we
described
in
the
beginning,
which
we
said
there
needs
to
be
a
commit.
There
needs
to
be
a
PR
that
needs
to
be
reviewed.
There
needs
to
be
a
tag
that
needs
to
be
the
result
of
that
PR
and
that
there
needs
to
be
a
container
that's
built
using
that
tag.
A
B
Oh
sorry,
essentially
we're
going
to
show
how,
when
Toro
is
able
to
detect
if
someone
comes
in
and
actually
tampers
with
that
workflow
we
just
displayed
and
maybe
puts
in
a
comment
that
that
wasn't
actually
supposed
to
be
there
and
we're
going
to
continue,
like
with
all
of
the
previous
steps,
again
build
the
container
again
from
that
previous
tag
and
everything.
But
when
it's
time
to
actually
verify
everything
right,
verify
automatic
metadata
that
was
just
collected.
A
Right
so,
basically
the
the
goal
of
intodus
to
detect,
if
there's
any
breakage
in
this
paper
trail.
If
something
happened
in
between
that
shouldn't
have
happened
in
total
is
able
to
detect
it.
It
actually
prints
a
very
user-friendly
Trace
that
says
like
here's,
where
we
started,
we
started
with
this
code
changes
and
eventually
I
got
into
this
commit
and
I
couldn't
make
it
into
the
tag,
because
there's
no
link
that
connects
one
or
the
other.
A
Let's
fast
forward
now,
this
is
the
result
of
again
a
lot
of
work
from
genre
and
Allen.
This
was
also
something
that
we're
very
happy
to
do
if
you're,
a
student
or
somebody
interested
in
participating
in
Google
form
of
code.
We
started
this
particular
demo
on
this
particular
extension
to
trace
GitHub
operations,
more
granularly
as
a
gold
summer,
Pro
of
code
and
yeah
I,
think
I
think
it
went
very
well.
This
is
one
of
the
demos
that
we'll
be
showing
today
now
this
is
the
state
of
in
Toto.
B
Hi,
so
in
Tolo,
as
primarily
a
specification
that
we've
you
know,
there
are
a
number
of
implementations
that
we
manage.
We
maintain
four
implementations
and
well
four
different
languages
and
and
the
specification
itself
can
be
extended
using
what
we
call
ites
or
in
Dota
enhancements,
and
you
know
a
good
chunk
of
these
end
up
being
implemented
as
well
in
one
or
more
of
the
aforementioned
implementations.
So
we
got
implementations
in
Python,
go
Java
and
rust.
The
python
is,
implementation
is
a
reference
implementation.
B
So
we've
had
a
number
of
ites
that
have
been
accepted,
got
several
more
that
are
currently
in
draft
status.
I'm
going
to
talk
about
a
few
of
the
key
items
here.
I
do
is
one
that
describes
how
we
can
use
another
cncf
project,
our
internal
sister
project,
tough,
as
a
root
of
trust
for
in
total,
and
what
what
this
allows
us
to
do
is
to
securely
distribute
not
just
the
artifact
but
the
metadata
in
order
metadata
captured
for
that
artifact
using
tough
properties.
B
It
also
helps
us,
you
know,
distribute
things
like
the
keys
used
to
verify
internal
supply
chain
securely
and
helps
identify.
You
know
which
batch
of
internal
metadata
must
be
trusted
for
a
particular
artifact,
and
things
like
that,
and
this
isn't
theoretical.
This
has
been
implemented
and
it's
been
used
in
production
for
years
or
at
datadog.
I3
is
I,
choose
like
sister
right,
which
is
informational
and
contains
all
the
details
of
datadox
specific
implementation
of
toughen
in
Toto
in
their
Pipelines.
B
We
have
I4,
which
enables
abstract
artifacts
in
total.
We
just
saw
that
in
action
actually
in
the
demo
that
Henry
and
Allen
put
together
to
capture
things
like
you
know,
GitHub
specific
objects
and
not
just
you
know,
get
specific
objects
and
recording
containers,
and
things
like
that.
It's
also
been
implemented.
B
B
If
someone
was
here
at
second
but
yeah
and
we've
defined
a
new
process
for
how
folks
can
contribute
to
these
predicate
types,
it's
a
standard.
One
I-9
and
we've
got
a
number
of
people
in
the
broader
and
daughter,
Community
Helping.
You
know,
provide
feedback
to
new
attestation
types
and
help
curate.
What
type
of
attestations
we
need
to
for
for
a
particular
use
case,
and
things
like
that.
B
I7
is
the
one
that
added
support
for
x509
certificates
to
in
total.
This
enables
Integrations
with
things
like
full
CEO,
six
stores,
full
Co
or
spiffy
spire,
and
any
other
Standalone
pki
setups
that
folks
have
and
want
to
use
in
total
with,
as
a
matter
of
fact,
the
spiral
integration
is
already
live
in
our
go
implementation
as
I
as
I
noted.
That
was
the
experimental
one.
So
that's
that's
ready
to
use
there,
but
yeah.
B
So
I'm
gonna,
like
wrap
up
sort
of
with
saying
that
a
lot
of
this
wouldn't
be
possible
without
the
broader
and
Total
Community
with,
like
you
know,
the
multiple
lights
they've
altered
and
the
contributions
to
the
radius
implementations
and
new
adaptation
types
that
are
coming
up
and
I
want
to
talk.
We
we
want
to
show
another
pre-recorded
demo
that
displays
in
total's
integration
with
key
lime,
another
cntf
project.
So
let
me
just
pull
that
video
up.
A
Well
he's
pulling
it
up.
Elaine
is
a
system
that
essentially
does
Hardware
based
tracking
of
whatever's
running
on
your
Cloud.
So
you
can
easily
connect
this
to
projects
together
and
say
well,
I,
don't
want
to
run
anything
that
doesn't
have
any
total
policy
attached
to
it
and
that
I,
don't
know
where
it
came
from.
I
want
to
know
that
every
single
line
of
code
running
on
my
infrastructure
was
reviewed
by
say
two
people
or
things
of
that
nature.
C
Hello,
Twitter
Community,
my
name
is
Marcus
Savers
I'm,
a
software
engineer
with
red
hat,
and
he
also
the
cto's
emerging
technology,
security,
team
and
I'm
here
to
talk
about
the
workout.
We
dig
right
and
then
supply
chain
within
Toto
and
UI
I'd
like
to
start
by
talking
about
the
supply
chain,
security
ecosystem
as
it
stands
for
the
past
year
and
a
half
there's
been
a
lot
of
great
work
on
tools
like
in
Toto
top
and
six
store
around
the
beginning
of
Supply
chains.
C
These
tools
do
a
great
job
of
recording,
a
testing
and
propagating
information
about
code,
origin,
and
this
makes
information
about
source
code
and
how
things
are
felt
very
easily
accessible
and
available,
which
means
that
you
have
somewhere
in
the
binary
that
use
these
tools
and
supply
chain.
A
consumer
of
that
binary
can
have
very
high
confidence
about
how
that
could
originated
or
where
it
came
from,
which
is
a
really
cool
story.
C
On
the
other
side,
we
have
a
great
story
for
the
end
of
Supply
chains
as
well,
which
is
d-line
if
you're
not
familiar
with
Clyde.
It's
a
cncf
hosted
project
that
provides
a
highly
scalable
remote
attestation
and
runtime
Integrity
measurement
solution.
Keylime
enables
users
to
monitor
remote
nodes
using
a
hardware
basic
cryptographic
group
of
trust.
So
what
does
this
mean
in
simple
English?
C
Well,
qlink
is
a
tool
set
that
allows
end
users
to
monitor,
what's
happening
on
some
client
system
and
to
attest
that
what's
happening
on
that
system,
the
things
that
are
running
machine
State
matches
what
it
was
expected
and
that
guarantee
that
that
guarantee
is
back
to
using
a
hardware
route
of
trust,
which
is
pretty
great.
That's
a
very
strong
guarantee
that
what's
happening
on
that
client
system
is
exactly
as
expected
issues.
C
These
two
student
stories
are
not
that
well
connected
with
Nintendo
6,
who
are
tough,
13
responsibility,
they
kind
of
end
after
distribution
and
there's
really
no
runtime
guarantee
that
running
code
matches
compiled.
You
know
that
that's
kind
of
missing
from
from
that
chain
on
the
other
side
g-line
does
provide
that,
but
it
still
relies
on
user
specified
policy
to
enforce
it's
hard
work,
its
guarantees
and
these
policies
there's
not
really
a
clear
story
for
where
they
come
from.
There's
they
could.
C
They
could
come
from
the
operating
system
vendor,
for
example,
which
might
cover
sort
of
the
base
layer,
OS
image,
but
that
may
not
cover
what
you're,
whatever
you
want
to
run
on
top
of
your
base
OS
and
that's
what
I've
been
working
on
kind
of
connecting
these
two
sides
of
starting
with
this
with
what
a
tool
I'm
calling
the
Supply
Chain
Bridge.
This
is
the
missing
middle.
This
connects
the
two
parts
of
the
supply
chain.
Together,
you
can
see
that
happening
in
this
diagram.
On
the
left.
That's
visualize
with.
C
Let's
say
you
have
a
GitHub
actions
pipeline
that
takes
your
source
code,
uses
the
wonderful
tools
and
total
and
stick
to
it
to
sign
and
upload
signing
evidence
to
to
a
transparency.
Log
produces
a
bunch
of
artifacts,
so,
in
addition
to
compiling
binary,
you'd
also
get
signatures
as
the
link
files
from
in
Toto,
and
this
will
be
attached
to
a
GitHub
release.
C
The
Supply
Chain
Bridge
will
take
the
signing
materials
that
are
now
publicly
available,
verify
them
and
and
kind
of
test
that
the
Providence
of
a
specific
binary
makes
sense
and
and
is,
is
correct
and
once
those
checks
passed,
then
it
will
forward
the
hash
of
that
binary
to
keyline,
which
can
then
monitor
monitor
for
it
on
end
user
Hardware,
which
concludes
the
loop.
That
creates
a
continuous
chain
of
trust.
That's
end
to
end,
which
is
really
the
goal
from
source
code
all
the
way
to
Harvard
and
that's
what
we're
gonna.
C
C
This
produces
a
lot
of
sign
materials
and
these
Iron
Hills
are
attached
to
a
GitHub
release.
You
can
actually
see
if
we
go
back
to
the
releases
page.
That
is
in
fact
the
case.
The
blaze
released
has
not
just
the
binary,
but
also
certificates
signatures
and
like
files,
which
is
great.
This
is
this,
is
the
information
now
public
available
on
on
the
internet
and
people
can
see
it.
C
The
second
repository
is
the
key
lime,
Supply
Chain
Bridge
itself,
and
this
Tool
consumes
that
GitHub
release.
It
seems
the
the
sign
materials
from
it,
verifies
them
and
takes
the
binary
that
that
is
part
of
that
release
and
takes
a
hash
and
forwards
it
onto
keyline,
which
connects
the
two
connects
key
lines
to
the
rest
of
the
supply
chain
ecosystem
and
we're
going
to
show
it
in
action
right
now.
C
What
we're
seeing
here
on
the
left
side
of
your
screen,
you
have,
we
have
a
you,
have
two
virtual
machines
on
the
left
side
is
one
of
them
called
key
line
for
the
door
one
and
on
the
right
side
is
a
second
called
d-line
through
door.
Two
connector
one
is
running
two.
Seven
things
running
the
key
line
verifier
in
the
middle
here
and
the
keyline
register
on
the
bottom
and.
C
Right
is
running
the
key
line:
agents
the
the
verifier
and
register
on
the
left
running
until
after
one
of
the
command
and
control
aspects
which
you
Monitor
and
and
and
orchestrate
the
agent.
So
this
is
an
agent
that's
working
on
a
separate
machine
and
the
agent
is
what
does
the
job
of
Hardware
annotation
and
making
sure
that
everything
is
looks
good
on
a
client
machine,
so
keyline
fit
R2
is
the
VM
that
we're
going
to
be
monitoring
today
to
facilitate
this
demo?
C
C
In
action
right
now,
I'm
going
to
run
it,
you
can
try
to
embrace
main.py.
We
have
to
write
a
number
of
inputs,
I'm
going
to
commit
an
owner
and
repository
on
GitHub,
so
this
corresponds
to
NSR,
slash
supply
chain,
pipeline
data,
so
I'm,
putting
in
two
words
this
Repository
and
what's
going
to
do,
is
going
to
look
at
this
repository,
find
the
latest
GitHub
release
and
then
graph
assigning
materials
from
that
release
and
and
then
verify
them.
C
In
addition,
I
specify
a
local
path
to
a
binary.
They
do
this
in
this
case,
I'm
going
to
specify
hello
go.
This
is
not
required.
You
can
leave
this
field
out
and
it
will
just
grab
the
binary
from
the
release,
but
in
this
case,
I
do
have
it
on
disk,
so
I'm,
gonna,
I'm
gonna
have
that
entry.
There
I
also
specify
a
destination
path.
C
This
is
where
the
binary
will
end
up
on
a
machine
that
will
be
monitored,
which
in
this
case,
is
this
Ira
right
here,
that's
just
after
hello
go
as
well
and
finally
I'm
going
to
give
it
the
alleles,
which
is
the
base
layer,
OS
policy,
the
mouse
password
to
indicate
that
I'd
like
to
do
sixth
flooring
and
total
checks.
When
I
run
this
we're
gonna
get
a
bunch
of
outputs
and
we're
going
to
see
what
that
looks
like
once.
C
C
Proof,
and
it
looks
like
that
passed
as
well
and
we're
going
to
run
against
some
Toto,
and
it
looks
like
that
passed
as
well
at
the
end
of
this,
since
we
run
all
these
textures
you're,
reasonably
confident
that
this
hash
of
the
binary
is
correct
and
is,
and
has
Providence
that
we
trust
so
we're
going
to
then
forward
this
hash
over
to
keylime
we're
going
to
take
the
existing
allowance.
That's
present
at
root.
C
Allow
subtext
we're
going
to
create
a
new
keyline
policy
that
has
this
hash
and
in
fact,
if
we
look,
we
do
have
this
policy
and
if
we
print
this
out
we're
going
to
see
a
bunch
of
hashes.
In
addition
to
addition
to,
at
the
very
end,
root
hello,
go
which
is
the
which
is
the
hash
of
the
binary
that
we
just
compiled,
which
is
great.
So
that
means
that
this
keyline
policy
now
has
information
about
our
verified
binary.
C
C
We
are
going
to
add
this
policy,
and
this
is
going
to
invoke
key
alarm
to
do
a
bunch
of
things
it's
going
to
set
up
the
agent
and
the
agent
is
now
set
up
with
this
policy,
and
it's
now
checking
constantly
checking
the
Integrity
of
Key
Lime,
fedora
2.,
and
it's
saying
that
everything
is
good.
They
checking
on
a
measurement
list
on
agent
text
loops
around
and
if
we
keep
seeing
that,
that
means
that
everything
is
in
good
shape
and
to
demonstrate
that
things
are
working
as
intended.
C
By
doing
so,
we
ran
our
code
and
it
seemed
like
everything
is
fine.
Everything
continues
to
work
as
expected,
which
is
great,
because
that
means
that
our
Province
information
that
started
from
source
code
made
it
all
the
way
down
to
hardware
and
is
being
reflected
when
we're
monitoring
it,
but
we
can
actually
go
further
than
this.
We
can.
We
can
show
this
working
incorrectly.
So
let's
say
we
modify
hello,
go
let's
say
we
do
go.
C
Let's
say
we
add
this
text
the
end
of
hello
go
once
we
do
and
we
run
a
logo
we're
going
to
see
that
key
lime
actually
recognized
it
and
it
tripped
it,
and
it
tells
us
that
root
hello
go
doesn't
match
the
expected
hash.
It
in
fact,
is
different,
which
is
great.
That's
exactly
what
we
want.
It
means
that
key
lime
work
does
intended
and
that's
it.
That's
the
demo
showing
that
product
information
from
Source
made
all
the
way
down
to
to
to
the
End
Hardware.
C
So
this
is
a
pretty
cool
demo
in
my
opinion,
but
there's
definitely
some
work
to
be
done
in
the
future.
There's
definitely
some
work
to
be
done
around
making
this
more
seamless
and
more
usable
and
there's
definitely
conversations
happening
in
the
kilometer
communities
to
Upstream
parts
of
this
Tool
into
the
main
code
basis
should
be
pretty
cool
and
I'd
like
to
continue
doing
that
work
in
the
future.
A
So
this
is
all
very
exciting
again
part
of
what
I
I
like
about
in
Toto
is
that
it
really
does
play
very
well
with
all
of
the
like
software
supply
chain,
Technologies
or
pretty
much
security
products
out
there.
We
actually
have
a
lot
of
Integrations
with
other
parts
of
the
cncf
landscape.
You
just
saw
something
with
key
lime,
toughest
sister
project.
A
We
have
pretty
much
been
the
home
of
salsa
since
its
Inception.
If
you,
if
you
look
at
the
salsa
Providence
at
the
station
at
the
very
top,
it
says
in
total
statement-
version
0.1,
that's
that's
how
we
We've
we
work
together
to
make
things
happen.
Cyclone
DX
beef
inspired.
You
saw
the
extensions
Beyond
on
the
open
source
ecosystem.
We
are
also
a
technique
to
say
very
fiber,
predictable
builds.
A
You
can
collect
Providence
at
stations
from
different
Builders
and
agree
and
check
if
they
agree
on
what
the
reproducibility
status
of
a
project
is
and
well
you
can,
you
will
find
us
in
many
many
places.
We
are
very
welcoming
Community
for
you
to
try
to
explore
and
experiment
with
a
different
software
supply
chain.
Solutions.
A
Please
well
I
invite
everybody
to
join
us.
There's
many
ways
to
reach
us
and
even
though
there's
all
only
a
minute
left,
you
can
always
also
hack
with
us
tomorrow
in
the
total,
tough
and
six
door,
Country
Fest
I
think
that's
a
great
way
to
get
started
in
space.
We
are
three
sister
projects
that
are
trying
to
set
the
tone
for
software
supply
chain
Security
in
the
coming
years,
and
thank
you,
I
think
we
have
very
little
time
for
questions,
if
not
at
all,
five
minutes.
Okay,
great.
E
A
D
D
F
Hey
I
have
a
question
about
how
precise
the
layouts
for
in
Toto
need
to
be
for
verifying
what
comes
or
verifying
what
you've
produced.
So
in
particular,
I'm
thinking
of
like
two
different
scenarios.
If
you're
using
some
sort
of
ephemeral
key
generation,
do
you
need
to
know
what
the
keys
are
in
advance
in
those
layouts
or
if
you
have
a
the
other
scenario,
if
you
have
a
multi-person
team,
and
you
don't
necessarily
know
who,
on
that
team
is
going
to
perform
a
particular
action?
A
Let
me
let
me
see
if
I
can
rephrase
the
question.
Basically
how
granular
do
you
need
to
be
in
your
layouts
and
also
in
particular,
what's
up
with
the
identities
of
the
actors,
like
probably
you
know,
beforehand,
who's
going
to
merge,
but
you
know
that
somebody
needs
to
merge.
I,
don't
know
from
that
company
or
something
like
that.
Yes,
there
are
semantics
to
like
there's
three
semantics
that
help
you
in
total
the
first
one.
It's
a
little
bit
more
about
the
granularity.
A
You
can
essentially
say
I,
don't
know
how
this
part
of
the
supply
chain
works,
but
I
know
this.
People
will
give
me
a
layout
to
describe
it,
so
you
can
make
like
recursive
calls
into
in
Toto
and
that
allows
you
to
like
abstract
out
parts
of
the
supply
chain
that
you
don't
know.
Maybe
you're
like
a
PM.
You
know
you
really
don't
know
what's
going
under
the
hood,
but
you
know
the
team.
That's
going
to
be
working
on
that
the
other
one
is,
you
can
actually
say,
give
it
a
set
of
keys
and
a
threshold.
A
So
you
say:
I
don't
know.
10
people
are
going
to
be
working
on
this
and
I
need
at
least
two
of
those
people.
To
give
me
evidence
of
a
merge,
I,
don't
know
which
of
them,
but
I
want
two
of
them
and
the
last
one
is
the
i7,
which
is
the
one
that
allows
you
to
work
with
identity
providers.
So
say
if
you're
using
keyless
in
fusio,
you
say
well,
I,
don't
know
what
key
is
going
to
be
there,
but
I
I
want
it
to
be
from
I.
A
Don't
know
this
email
account
and
it
also
works
very
well
with
beefy
Inspire
when
you
have
ephemeral
workers,
so
you
say
well,
I
just
want
a
cert
from
this
chain
rooted
in
distrust.
It's
going
to
be
some
worker
on
some
machine
in
the
cloud.
I,
don't
know
exactly
which,
but
just
verify
this
chain
of
trust.
All
the
way
to
this
root,
and
with
this,
like
particular
constraints
on
the
search
chain,
does
that
kind
of
awesome.