Skip to content

Identity-based Trust — Till Death Do We Part?#

KubeCon + CloudNativeCon Europe 2025 (London) digest Program Core pick London · 1–4 April 2025

Abstract Recording

John Kjell, ControlPlane & Kairo De Araujo, Independent — Core

Play the recording: Identity-based Trust — Till Death Do We Part?

  • Why: A threat-model-first look at OIDC-based "trusted publishing" (PyPI, npm, RubyGems, Homebrew, all built on Sigstore's Fulcio/Rekor) — directly relevant to identity infrastructure design, specifically the hard problem of what happens when the identity backing a signature is compromised in an append-only trust log.
  • What: A threat model for compromise in Sigstore-based identity signing systems, and mitigation/recovery mechanisms using in-toto and The Update Framework (TUF), including a concrete implementation in in-toto's Archivista sub-project. (from abstract only)
  • How: Sigstore's Rekor transparency log is append-only with no entry removal, so identity compromise can't simply be "erased" — the talk covers mitigation and recovery patterns that work within that constraint rather than against it. (from abstract only)
  • Where applicable: General for OIDC-based signing/attestation systems (trusted publishing, artifact signing); specifically relevant to anyone building or relying on Sigstore-backed supply-chain identity.