Skip to content

TUF-en up Your Software Supply Chain#

KubeCon + CloudNativeCon Europe 2025 (London) digest Program Adjacent pick London · 1–4 April 2025

Abstract Recording

Marina Moore, Edera & Kairo De Araujo, Independent — Adjacent

Play the recording: TUF-en up Your Software Supply Chain

  • Why: Complements the identity-trust talk above from the artifact-integrity side — how The Update Framework (TUF) and in-toto tie signed images to supply-chain metadata for end-to-end verifiable distribution.
  • What: How to securely distribute container images along with supply-chain metadata (SBOMs, attestations) using TUF for update/distribution security and in-toto for attestation verification. (from abstract only)
  • How: TUF ensures image and metadata freshness and tamper-resistance; in-toto layers on attestation verification for a combined secure-distribution pipeline, demonstrated live. (from abstract only)
  • Where applicable: General software supply-chain security for container image distribution; relevant to anyone building or evaluating SBOM/attestation pipelines.