Zero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE

Overview Dan Lawrence explains how to implement zero-trust supply chain security by combining open source projects like SPIFFE, Tekton, and Sigstore. Supply chain attacks increased 650% in 2021, exploiting the fact that software build systems are often treated as less critical than production infrastructure. The presenter demonstrates that traditional perimeter-based security fails when attackers pivot through vendors and dependencies rather than attacking targets directly.

Key Topics The talk covers major supply chain attacks from 2021 including SolarWinds, CodeCov, dependency confusion, Travis CI secrets leak, and VS Code branch protection bypass. Lawrence explains zero trust as moving beyond network perimeters and allow-lists to identity-based verification for every artifact. The core principle: every artifact must be cryptographically verifiable back to its source code and the hardware it was built on, with provenance captured at each step. Traditional approaches trust everything inside a boundary and assume everything outside is dangerous; zero trust bases trust decisions on individual entities and their history.

Technical Architecture The reference architecture uses three main components: SPIFFE/SPIRE provides workload identity and hardware attestation through TPMs, proving machines are in known-good states before issuing credentials; Tekton provides Kubernetes-native CI/CD with declarative pipelines and automatic provenance capture separate from build scripts; Sigstore provides free code signing certificates stored in tamper-proof transparency logs. The system captures provenance at every step—not just at the end—enabling policy enforcement based on how artifacts were produced rather than where they currently reside. Service accounts are scoped per-build rather than globally shared, ensuring fine-grained identity.

Demonstration The presenter traces a container image back through multiple build systems and signatures. Starting with a final image digest, he uses Cosign to find signatures in Sigstore transparency logs tied to specific GitHub Actions runs. The provenance includes the exact commit hash and action run ID. Following the base image annotation, he traces to another image built by Tekton in a Kubernetes cluster using workload credentials from SPIFFE/SPIRE, examining the actual build provenance statement showing source repository, commit hash, exact tool versions, and bash scripts executed. This allows jumping between build systems and verifying the chain all the way to developer signatures on source commits.

Key Challenges and Principles Hardware attestation depth varies by infrastructure; cloud providers offer vTPMs and workload attestation while on-premises environments can use TPM 2.0. Build systems themselves must change to capture provenance out-of-band from build scripts, preventing compromise of the script from affecting attestation. Legacy Jenkins boxes require significant patching, while managed services like GitHub Actions benefit from automatic feature rollouts. Supply chains are recursive—every dependency has its own supply chain requiring verification. Organizations must treat build systems as production infrastructure and apply the same security rigor.

Takeaways Implement zero trust by capturing and verifying provenance at every supply chain step using open source tooling. Base policy decisions on artifact provenance rather than repository trust. Even simple projects like container images depend on multiple build systems, base images, and tool versions that must all be verified. As supply chain attacks accelerate and governments recognize this as a national security threat, these practices are becoming essential for software organizations.