►
From YouTube: CNCF SIG Security Supply Chain Security 2021-03-26
Description
CNCF SIG Security Supply Chain Security 2021-03-26
A
B
A
A
D
F
G
H
D
H
H
A
A
I
think
we
still
have
some
way
to
go
on
that
piece,
but
we'll
see
in
terms
of
in
terms
of
going
through
is
in
this
providing
a
single
narrative.
Can
I
ask,
maybe
rich
marina,
I
think
alex
as
well?
Was
that
really
your
intent
as
you
went
through
it,
or
is
it
more
just
editing
it
from
top
to
bottom
perspective,.
I
A
Sorry
I
lost
that.
Oh
did
we
just
lose
richard
and
then
we
just
lost
richard
okay,
so
we
still
need
to
do
the
the
single
voice
narrative
in
terms
of
areas
of
the
document
that
choppy,
I,
I
think,
blake
you
me
and
richard
are
probably
chewing
on
20
to
40
still
a
little
bit,
let's
face
it,
but
what
about
the
rest
of
the
document?
I
guess
from
from
your
review.
Everyone
else.
A
I
C
I
A
Yep,
I
think
I
added
a
chunk,
or
at
least
created
the
suggested
edits
for
ch.
They
might
have
been
merged
in
actually
or
deleted
one
of
the
two
all
lost
somewhere
in
between
that,
but
so
let's
do
that.
Let's
go
in
high
medium
risk.
We
can
certainly
do
that
part
of
it.
The
the
other
bit
that
I
I
kind
of
wanted
to
to
highlight
was
the
actual
recommendations
that
we've
made
and
whether
we
actually
agree
to
that
as
a
group,
because
I
think
that's
pretty
fundamental
right.
A
If
we've
got
something
here,
we
disagree
with
or
we're
missing
something
we
should
probably
evidence
it
fairly
promptly
yeah,
so
it
was
actually
hi
magno.
Welcome
to
the
group.
Thank
you.
I
think
it
was
last
week
on
the
22nd
of
march
I
sent
through
a
document
and
all
it
was
supply
chain
recommendations.
Rdf
and
all
I
did
was
I
just
pulled
out
the
recommendations
put
them
in
his
bullets,
just
so
that
we
could
sort
of
stand
back
a
little
bit
and
figure
out.
Look
all
things
being
equal.
A
These
are
the
actual
recommendations
we've
made.
Do
we
do
we
actually
agree
with
this
or
are
the
chunks?
We
missed
right,
just
wonder
if
we
can
spend
like
five
minutes
just
reviewing
that
to
see
if
we've
actually
missed
something
or
we
agree
on
it,
and
then
we
can
add
that
into
the
paper
and
move
on
and
then
look
at
the
high
medium
and
low
recommendations
at
the
bottom
and
then
figure
out
any
recommendations
yeah.
So
if
you,
if
you
go
back
in
slack
to
like
the
22nd
of
march
I'll,
also
see
what
you
see.
A
A
H
From
sas,
I'm
trying
to
figure
out
if
that's
a
set,
but
it
overlaps
with
other
things,
is
the
problem
because
it
can
perform,
can
perform
vulnerability
scanning
and
can
perform
configuration
scanning.
But
I
was
actually
wanting
to
reference
it
from
the
build
pipeline
steps
later
on
that
we're
talking
about
no.
H
B
B
B
That
was
what
I
had
said.
I'd
do
is
put
an
appendix
at
the
bottom
of
the
document
and
then
list
out
all
the
stuff
over
there
now
container
scanning,
because
of
the
way
containers
are
built
you
know
is,
is
not
something
that
someone
can
totally
rely
on.
So
I
think,
with
regards
to
containers,
we
could,
I
would
recommend
you
know,
taking
the
results
with
a
grain
of
salt.
H
H
H
H
I
don't
know
interest,
not
not
s
bom
from
source,
but
s
bomb
from
what's
actually
installed.
So
it's
not
if
you
could
accomplish
the
same
thing
by
other
tools.
It's
not
strictly
container
scanning
as
my
recommendation,
but
it
would
be
figure
out
what
you
actually
have
in
your
containers
and
figure
out
if
your
containers
are
configured
correctly,
because
that.
G
G
M
L
H
H
L
A
G
Well,
I
have
one
with
the
that
secure
authentication
right.
There
is
a
usage
of
pad
for
a
ci
cd
pipeline,
which
is
not
really
weighted
against
ssh
to
say
that
you
know
that
should
go
as
a
recommendation
right.
So
if
we
can't
put
the
pros
and
cons
for
both
approach,
I
think,
in
my
view
we
shouldn't
recommend.
I
mean
just
blindly
recommend
one
option
right
so
yeah
and
also
there
is
inconsis
yeah
go
ahead.
A
C
H
A
A
H
G
G
G
A
A
M
F
I
Libraries,
because
I
think,
if
they're
already
reproducible,
it's
a
little
bit
redundant
to
have
to
build
them
yourself.
Basically
like.
I
think
the
idea
is
to
have
some
kind
of
verification,
but
I
don't
think
that's
the
only
way
to
have
some
kind
of
verification
that
the
resulting
artifact
comes
from
the
source
code.
A
A
A
A
A
A
C
O
Yeah,
sorry,
sorry,
I
thought
I
had
unmuted
looking
at
it
in
the
dock.
It
looks
that
validate
the
configuration
and
security
of
the
system
after
deployment
recommendation
looks
pretty
minimal
as
well,
and
I
think
it
probably
is
mostly
covered
in
the
cryptographically
guaranteed
one.
So
it
might
be
a
candidate
for
cutting.
A
A
L
F
C
A
A
I
mean,
I
guess
the
way
that
I
think
you
think,
or
was
thinking
of
that
one
was
like.
You've
stood
up
your
it's
like
the
power
on
self-test
right.
It's
like
you've
stood
up
you're,
a
software
factory.
You
you've,
you've
done
or
your
pipeline
you've
done
everything
you
can
to
make
sure
you've
secured
that
thing,
but
do
you
want
to
run
a
suite
of
tests
against
it
to
validate
that
it
is
still
stood
up
as
you
expected
to
be
stood
up.
A
You
know
fire
payloads
at
the
thing,
try
to
fire
off
certain
attacks
against
it
to
to
make
sure
that
it
is
secure,
as
you
expected
it
to
be,
not
just
check
to
make
sure
configuration
files
are
set
up,
but
you
know:
can
you
connect
to
it
via
http?
Can
you
just
manually
insert
some
step
or
something
yeah.
F
L
A
A
Right,
I
think
I
think
it's
more
than
that,
though,
and
I
think
it
includes
that,
but
it's
more
broad
statement
is
that
I
I
am,
I
want
to
make
sure
that
it
I
want
to
prove,
provide
efficacy
testing
I
want
to.
I
want
to
prove
that
some
of
the
to
an-
and
this
point
you
know
almost
to
the
full
reasoning
perspective.
I
know
what
these
inputs
are.
A
I'm
going
to
put
these
inputs
in
I'm
going
to
run
this
build
or
scan,
and
I'm
expecting
it
to
show
this
output
or
I'm
going
to
flat
out,
try
and
try
and
delete
one
of
the
stages
it's
supposed
to
be
immutable,
so
it
shouldn't.
Allow
me
to
do
that
and
just
validate
that
I
can't
do
some
of
that
sort
of
stuff.
F
A
A
L
A
A
A
A
A
A
F
F
Well,
people
are
not
pulling
pulling
things
off
the
internet,
so
how
do
those
things
make
it
into
the
environment
and
everything
at
that
point
whatever
goes
into
the
the
repository
in
the
air
gap
environment
should
be
strongly
attested.
A
lot
of
things
can
be
said
about
about
that.
There's
there's
several
different
dimensions,
but
should
we
spin
it
that.
F
A
A
B
A
F
A
F
A
A
L
Sir
yeah
yeah
use
container
signing
or
artifact
signing
yes,
and
then
we
provide.
Oh
here
are
some
tools
that
do
that,
but
point
directly
at
at
like
our
tools
as
cncf
tools,
I'm
not
sure
they
can
use,
they
can
have
other
options
right
and
sometimes
they
prefer
the
enterprise
version
of
that
because
of
support
and
other
things.
F
L
A
Madness
right,
I
I
know:
how
does
this,
how?
How
did
we
do
this
in
the
container
security
paper,
because
we're
in
the
middle
of
the
cncf
right
I
mean,
I
think
we
should
state
the
generic,
but
also
reference
these
specific,
especially
within
the
cncf.
It's
like
a
first
or
identifier.
This
is
a
gap,
but
I'm
interesting
how
it
was
been
done
in
the
other
papers.
A
F
Whatever
we
think
adds
the
most
value
to
someone
reading
the
paper
and
like
our
view
of
the
world,
is,
is
very
cloud
native
right,
yeah
this
reality
or
like
the
reality
around
this
is
these
are
the
things
we
see
really
close
to
us.
Therefore,
those
are
the
ones
we'd
recommend,
so
we,
I
think
it's
fair
game
to
to
call
out
explicit
things,
because
people
read
this
thing.
It's
like,
oh
conceptually,
this
all
sounds
great,
but
what
tools
should
I
be
using.
A
F
F
A
F
A
A
A
D
D
D
D
D
F
D
In
terms
of
in
terms
of
the
next
steps
I
mean
we
have,
I
think,
edit
wise
we're
mostly
focused
at
this
section
with
the
the
recommendations
right.
We
I
alex,
I
guess
we
don't
have
we
definitely
we
don't
have
cole
or
or
blake
anymore,
but
the
the
preceding
sections
do
we
need
to
go
over
that
at
all
anymore.
D
A
A
Exactly
and
I
think
too,
I
think
it
was
niche's
point.
The
reality
is
right
at
the
bottom
of
the
document.
There
are
a
couple
of
a
couple
of
orphan
things.
I
think
these
couple
of
things
that
could
do
with
an
owner
yep,
but
you
know,
I
think,
in
the
next
15
minutes.
If
we
just
get
the
assurance
category
in
risk
category
and
everyone's
happy
with
what
those
are
we'll
add
the
feedback
we
just
had
in
today.
F
L
A
B
D
A
L
A
There
are
other
things
available
and
d-bum
is,
is
certainly
fairly
early
in
in
my
view,
but
if
we
are,
I
I
think
this
is
reasonable,
because
I
don't
know
necessarily
there's
a
particular
solution
for
it.
Maybe
that's
a
gap
when
we
highlight
it,
but
we
have
to
have
the
ability
to
share
that
s-bomb
data
securely
yeah.
D
A
A
A
M
I
was
curious,
sorry
yeah.
I
was
curious
about
the
bullet
points
under
ensure
clients
can
verify
the
freshness
of
files
and
there's
a
comment
that
they
need
to
be
converted
into
recommendations
they're,
basically
about
validating.
You
know
s-bombs
and
toto
metadata
admissions
controllers.
So
on
oh
right,
there.
A
B
I
I
I
don't
know,
I
would
expect
that
you
know
if
anyone
wanted
to
validate
any
of
the
supplemental
artifacts
such
as
signatures
and
s-bombs,
they
would
validate
the
signatures
on
the
on
these
things.
So
I
would
expect
that
if
anyone
is
creating
an
s-bomb
along
with
an
artifact,
they
would
sign
both
the
s-bomb
and
the
artifact.
A
M
They
aren't
connected,
I
think,
they're
left
over
from
when
the
section
was
first
kind
of
put
together
and
we
were
thinking
of
what
needs
to
go
under
securing
deployments,
yeah,
absolutely
right,
general
and
also,
if,
if
I
think
I
think
this
is
similar
to
what
nishow's
saying,
but
if,
if
someone
is
using,
if
they've
already
made
a
recommendation
that
they
need
to
use
in
total,
they
need
to
do.
You
know,
create
s
forms.
M
A
M
B
A
M
I
yeah
I
can
so
I
I
think.
Okay,
sorry,
I
I
really
don't
want
to
make
this
very
in
total
specific,
but
I
I
do
want
to
note
that
the
recommendation
there
probably
goes
beyond
just
validating
the
signature
on
the
metadata
files,
because
nintendo
has
its
full
verification
workflow
as
well,
where
the
link
in
their
files
are
matched
against
each
other.
M
J
B
F
A
A
F
F
F
F
L
A
Yeah,
exactly
otherwise
you'll
never
end.
Okay,
I
think
we've
got
to
the
bottom
of
that.
We've
updated
the
that
list.
We
haven't
had
time
to
go
through
the
different
insurance
categories
and
only
got
three
minutes
left.
What
what
I'd
suggest
is?
Maybe
does
anyone
want
to
have
a
go
at
it
and
dedicate
themselves
to
just
adding
initial
thoughts
around
the
assurance
categories
and
risk
categories
and
then
add
a
comment
back
onto
slack.
O
I
think
marina
also
raised
this
point
in
her
review
that
she
sent
in,
but
a
similar
point
that
I
would
make
is
I'm
I'm
not
sure
reading
through
this
of
any
situation
where
those
are
going
to
diverge
from
one
another.
So
I'm
wondering
if
there's
any
point
in
having
those
as
two
separate
I
mean,
I
think
it's
it's
worth,
defining
them
as
two
separate
things,
but
in
our
recommendations
I
feel
like
they
pretty
much
are
always
going
to
be
the
same.
A
Yeah
I
I
kind
of
agree
with
the
risk
and
insurance
thing,
because
it's
I
think
it's
useful
to
stating
that
there's
a
problem
or
there's
differences
at
the
top,
but
actually
kind
of
almost
state
a
single
one.
But
but
I
think
I
think
there
are
situations
where
we
have
moderate
versus
high.
Certainly
when
we
get
to
those
controlled
environments,
it'd
be
interesting
actually
to
see
if
all
of
the
highs
are
actually
corralled
effectively
in
the
air-gapped
environments.
A
A
F
A
But
what
are
we
saying,
though,
because
is
it
there?
Is,
I
guess
if
we
I
think
we
need
some
level.
I
I
agree.
We
probably
don't
need
two
or
for
my
view,
I
don't
it
gets
lost
really
whether
we
need
we
need
assurance
and
risk,
so
maybe
just
have
one,
but
I
think
it's
useful
to
have
one
of
them
to
say
it's
moderate
or
high.
F
I
think
I
think,
even
for
the
moderate
ones,
they
are
moderate,
slash
high
and
a
lot
of
it
is
well
we're
trying
to
get
people
to
improve
their
posture.
So
we
want
yes
like
you're,
going
to
have
higher
degrees
of
assurance
and,
like
we
want
you
to
know
the
risk
that
goes
with
it,
but
it's
almost
implicit
so.
L
A
Environments
that
are
depending
on
what
your
definition
is
like
highly
secure
and
super
super
regulated
and
even
then
only
the
absolute
top
at
the
top
yeah.
That's
a
great
recommendation.
You
definitely
do
that,
but
if
people
read
the
paper
and
think
wow
the
recommendation
is
we
actually
want
to
rebuild
the
source
for
all
of
our
libraries.
That's
that
might
give
the
wrong
impression.
F
Yeah,
so
how
about
I,
I
suggest
the
following,
and
I
I
volunteered
to
do
it
instead
of
having
it
assurance
category
skull
and
risk
category
spawn.
I
can
collapse
this
into
one
sentence
yep
before
the
paragraph
would
say
for
this
particular
item.
We
want
you
to
know
that
the
assurance
category
is
between
moderate
and
high,
and
the
risk
categories
are
such
it
solves
it
from
like
a
just
looking
at
it
and
not
actually
reading
through,
and
we
have
a
little
bit
more
room
at
qualifying.
That.
K
K
A
K
A
I
don't
feel
as
bad
now
it's
good
safety
in
numbers,
good.
I
I
think
that's
that's
great
idea
and
yeah.
That's
cool
we're
a
couple
of
minutes
over,
but
I
think
we've.
I
think
this
is
really
coming
together.
I
think
I
think
the
the
sort
of
focus
really
on
20
to
40
made
a
big
difference.
Then
we
just
need
to
collapse
all
that
stuff
in
and
then
we're
in
decent
shape.
What
we,
what
we
didn't
identify
was
who
was
going
to
go
top
to
bottom
with
the
single
voice
commentary.
A
O
K
A
That'd
be
that'd,
be
awesome,
andy
thank
you
and
if,
if
we
left
it
to
you,
the
graphics
would
be
all
sorts
of
cats
and
massive
amounts
of
very
cool
animations.
So
if
you
just
stick
to
the
verbiage,
that'd
be
awesome
very
good.
Yes,
great!
Okay!
Thank
you
we're
a
little
bit
over.
So
apologies
for
that,
but
thanks
very
much
for
your
time
and
we'll
keep
I'll
put
notes
in
the
slack
and
we'll
take
it
from
there.