►
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Keynote: Reality Check: Is it Time to Raise Your Metrics Game? - Asra Ali, Software Engineer, Google Cloud
This talk will briefly describe examples of how sigstore is already being used to improve supply chain security through integration with frameworks like SLSA, FRSCA, and others to secure build provenance, SBOMs, release artifacts, etc. It will also give a glimpse to other integration opportunities to expand the use of sigstore-based digital signatures across the broader OSS ecosystem.
A
So
hi
everyone,
my
name-
is
australi
and
I'm,
a
software
engineer
at
Google
on
the
Google,
open
source
security
team
and
before
this
I
used
to
work
on
Envoy,
which
is
another
CNC
I've,
hosted
project,
and
then
before
that,
I
was
working
on
privacy.
Preserving
protocols
and
I
really
do
love
cryptography
and
math.
So
about
any
of
those.
A
If
you
want
to
talk
about
that,
I'm
totally
happy
so
today,
I'm
just
going
to
quickly
wrap
up
our
Keynotes
and
then
you
know
introduce
the
the
rest
of
the
stuff
with
kind
of
what
I
view
as
what
is
so
amazing
about
Sig
store
and
why
Sig
store
can
move
us
from
like
a
whole
different
game
and
system
of
securing
our
supply
chain.
So
I'm
kind
of
going
to
give
two
of
the
principles
that
I
think
are
really
the
core
reasons
why
Sig
store
is
cool
and
important
and
not
just
any
old
signing
tool.
A
Thank
you,
oh
yeah.
This
is
totally
why
okay,
so
the
first
that
I
want
to
talk
about
is
signing
with
strong
bindings.
So
as
you
kind
of
go
throughout
the
day-
and
you
start
learning
about
people's
Integrations
their
tooling-
and
you
know
why
they're
using
six
store,
I
kind
of
want
you
to
keep
this
idea
in
mind
about
how
sigster
provides
you
with
a
capability
of
producing
identity
based
signatures.
So
in
priyo's
demo,
which
was
awesome,
you
got
to
see
how
pre-abided
her
identity
to
or
get
commit.
A
But
it's
not
just
identities
like
your
email
or
your
personality.
It's
also
places
like
where
are
you
running
your
code
and
what
is
the
identity
of
the
place?
You're,
actually
creating
some
sort
of
data,
and
so
with
that,
you
kind
of
get
this
really
interesting
and
key
property
of
being
able
to
integrate,
with
other
sorts
of
Frameworks
like
spiffy
Spire,
in
order
to
produce
and
actually
practically
achieve
a
lot
of
the
supply
chain.
Security
Frameworks
like
salsa
and
Fresca
in
actual
practicality,
and
what
I
think
is
kind
of
of
crazy.
A
Is
that
without
this
sort
of
identity
based
components,
a
lot
of
what
we're
able
to
do
would
not
have
been
possible.
I,
like
never
would
have
been
able
to
imagine
achieving
some
sorts
of
high-level
salsa
attestations
on
free
platforms
without
the
use
of
these
identity
based
signatures.
So,
as
the
time
goes
on
and
like
you
know,
as
the
day
goes
on,
I
really
encourage
you
to
think
like.
Where
else
can
we
be
using
these
identity
based
signatures?
What
other
sorts
of
identities
can
we
integrate
with?
A
So
the
next
thing
that
I
want
to
talk
about
is
this
transparency
first
principle,
so
I
really
really
love
this,
and
also
coming
from
a
place
of
not
trusting
many
people
or
just
being
an
inherent
skeptic
I.
Think
the
idea
of
having
transparency
first
everywhere
is
a
really
awesome
and
cool
property
that
we
can
start
to
leverage
even
more
so
what
I
think
is
awesome.
A
So
this
is
the
record
logo,
if
you
don't
know,
is
that
originally
a
lot
of
you
may
have
thought
record
is
just
there
to
provide
this
signature,
validation,
property,
we're
using
a
lot
of
these
short-lived
certificates
based
on
identities,
and
we
need
a
place
where
we
can
make
sure
that
they,
the
signing
events
actually
occur
during
certificate
validity,
but
I
don't
think
it's
just
that.
I
think
that
having
a
recore
log
or
a
transparency
log
is
actually
more
important
than
just
that
it
provides
auditability.
A
A
No,
no,
that
is
a
joke,
and
I
really
hope
that
I
can
continue
to
speak
at
this
event
and
I'm
sure
yeah.
Many
of
you
realize
I'm
not
actually
being
serious,
but
what
we
do
start
to
see
is
that
there
are
lots
of
ways
that
we
can
start
integrating.
This
transparency
log
information
in
places
like
guac
on
the
right
hand,
that's
a
graph
of
attestations
and
s-bombs
and
related
material
that
we
start
to
Aggregate
and
collect
what
I
think
is
really
cool.
A
Is
that
there's
this
local
Global
mapping
that
we
have,
if
any
of
your
mathematicians
I
just
wanted
to
say
that?
But
we
have
this
like
global
view
of
all
these
attestations
in
the
world
that
we're
living
in
now
with
this
local
view
of
you
know,
can
you
use
this
internally?
Can
you
use
this
for
fetching
a
single
package
and
with
the
ability
to
kind
of
view
both
of
those
together?
A
You
get
this
entire
Rich
set
of
information
that
you're
able
to
leverage
in
all
sorts
of
new
ways
days
so
with
that
I'm
just
going
to
conclude,
and
thank
you
all
thank
you
to
Luke
and
Priya
for
giving
those
amazing
Keynotes.
Thank
you
to
the
PCS,
the
organizers,
the
MCS
and
everyone
here,
who's
able
to
sort
of
share
their
thoughts,
their
ideas,
their
contributions
and
yeah
I'm
excited
to
talk
with
all
of
you.
So
please
give
me
a
shout
out.
Please
talk
to
me.
Please
talk
to
me
about
Bitcoin
and
yeah.
Thank
you.