TestifySec retweeted
Great blog post by @colek42c published on @testifysec website about comparing #intoto and @projectsigstore; you will find very niche details about them; don't forget to read it 👇
testifysec.com/blog/sigstore…
TestifySec retweeted
In-toto vs. sigstore: what are they and how do they differ? 🧵 👇 @projectsigstore @torresariass #intoto
TestifySec retweeted
You can now generate in-toto metadata via a GitHub action, thanks to @colek42c's work at @KubeCon_'s in-toto + TUF + @projectsigstore ContribFest! github.com/marketplace/actio…
TestifySec retweeted
Petition to start calling these GUESSBOMs! 💣💣💣
TestifySec retweeted
We just landed initial @witness_dev support for @github.
This uses a preview build of Witness with #Archivist support.
A GitHub attestor, and Keyless signing should drop before Kubecon. Let me know if you give it a whirl.
github.com/testifysec/witnes…
TestifySec retweeted
Have you ever wondered how to inventory all the dependencies in a software build?
In this talk, I will showcase how end users can create and use #BPF traces to minimize #CVE false positives and negatives with @witness_dev and @ciliumproject #tetragon
sched.co/1AOie
TestifySec retweeted
We had a user post an issue that hit an edge case we didn't test for. Our team fixed the issue the next business day, along with unit and integration tests. I couldn't be more proud of our engineering team led by @mikhailswift
TestifySec retweeted
I started adding support for the SPIRE delegated identity API to @witness_dev today. This lets us sign attestations based on the shasum of the CI command being run. Great work on this powerful API @SPIFFEio team!
TestifySec retweeted
We use @SPIFFEio as a way to distribute trust, using remote attestation in our Judge platform. However, we don't expect our users to understand Spire, and spire registrations. We are making great progress on federating SPIRE and making registration easy.
asciinema.org/a/ieVRO9nQ3AZx…
TestifySec retweeted
Sometimes the supply chain attestation stuff gets complicated to follow. I liked this demo gitlab-ci.yml that @testifysec put together to implement @witness_dev
gitlab.com/testifysec/demos/…
TestifySec retweeted
There were 12,000 software supply chain incidents recorded in 2021, a 650% increase over the prior year.
In my latest blog with Aquia Inc I discuss:
- Relevant software supply chain attacks
- Lack of developer focus on producin…lnkd.in/efWxejFt lnkd.in/eQrPURy9
TestifySec retweeted
We had a great time working with @CircuitSwan and @gitlab securing a pipeline with @witness_dev and @projectsigstore.
about.gitlab.com/blog/2022/0…
TestifySec retweeted
SLSA Level 3!
We have been working hard on those #verify checkmarks!
@witness_dev can now verify multiple steps by building a graph of the CI process and associated attestations!
Stay tuned for a blog post on how to integrate @witness_dev with @gitlab
gitlab.com/testifysec/demos/…
TestifySec retweeted
IMO Zero Trust is about two major things. 🛂 Identity and 📜 Policy around Identity. Having strong identity guarantees around principals and workloads. And having a policy framework that enforces access control, input, etc around these identified entities. 3/
TestifySec retweeted
Hacked up a quick Dirty Pipe PoC that spawns a shell by hijacking (and restoring) the contents of a setuid binary. haxx.in/files/dirtypipez.c
TestifySec retweeted
@witness_dev can now produce and verify an #SBOM for any OCI image with a little help from the @SyftProject
Thank you @danluhring and @anchore for your help!
TestifySec retweeted
Oh wow, @projectsigstore is coming to Maven Central: central.sonatype.org/news/20…
"Sigstore is literally designed to solve this problem with elegance and runtime properties that are especially appealing in common Java development and CI environments."
Nice work @sonatype!