Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Understanding the Identity of a CI Platform

Avatar for Richard Fan Richard Fan
November 12, 2024
Technology
9
0

Understanding the Identity of a CI Platform

Presented at SigstoreCon 2024

Avatar for Richard Fan

Richard Fan

November 12, 2024

More Decks by Richard Fan

See All by Richard Fan
You Don’t Need to Be a Hero to Contribute
Avatar for Richard Fan richardfan1126
0
5
JAWS Pankration 2024 - Achieve software supply chain security using AWS Nitro Enclaves and GitHub Actions
Avatar for Richard Fan richardfan1126
0
70
Preserving privacy on data collaboration with AWS Clean Rooms
Avatar for Richard Fan richardfan1126
0
53
Achieve software supply chain security using AWS Nitro Enclaves and GitHub Actions
Avatar for Richard Fan richardfan1126
0
170
When Data Collaboration Meets Privacy: Privacy-enhancing Technologies on AWS
Avatar for Richard Fan richardfan1126
0
62
AWS Security Hub Central Configuration - An Easy way to monitor your Organization security posture
Avatar for Richard Fan richardfan1126
0
75
Create your first AWS Nitro Enclaves application
Avatar for Richard Fan richardfan1126
0
70
Building Security Data Lake
Avatar for Richard Fan richardfan1126
0
22

Other Decks in Technology

See All in Technology
AI駆動開発が変える、大規模開発の前提 ーHuman in the Loop から Human on the Loop へ / AIE2026
Avatar for Visional Engineering ＆ Design visional_engineering_and_design
2
1.5k
Chart.js が簡単に使えるようになっていたので OGP 画像生成に使った話
Avatar for すずとも kamekyame
0
130
PHP と TypeScript の型システム比較：AI 時代の「型」は誰のためにあるのか？ #frontend_phpcon_do / frontend_phpcon_do_2026
Avatar for shogogg shogogg
1
240
もりもり新機能を一挙紹介！ AgentCoreに入門して、AWS上にAIエージェントを構築しよう
Avatar for みのるん minorun365
PRO
6
670
探して_入れて_作って_使う_Agent_Skills___LT.pdf
Avatar for 松尾淳平 peintangos
2
150
価格.comをAI駆動で全面刷新する ー 30年分の技術的負債を返し、次の30年の土台をつくる ー / AI Engineering Summit Tokyo 2026
Avatar for tkyowa tkyowa
17
17k
個人AIからチームAIへ：開発における品質と生産性の再設計
Avatar for Atsushi Nakatsugawa moongift
PRO
0
360
電子辞書Brainをネットに繋げてみた(自力編)
Avatar for らすぴー raspython3
0
420
Java正規表現エンジン（NFA）の仕組みと パフォーマンスを維持するための最適化手法
Avatar for 竹内 雅和 takeuchi_132917
0
170
Gradle×GitHub_ActionsでCI時間を約50%短縮 ジョブ分割の設計と落とし穴 / Cutting CI Time by ~50% with Gradle and GitHub Actions: Job-Splitting Design and Pitfalls
Avatar for 冨澤宝斗 takatty
0
600
Oracle AI Database@AWS：サービス概要のご紹介
Avatar for oracle4engineer oracle4engineer
PRO
4
2.8k
OCI Oracle AI Database Services新機能アップデート(2026/03-2026/05)
Avatar for oracle4engineer oracle4engineer
PRO
0
120

Featured

See All Featured
jQuery: Nuts, Bolts and Bling
Avatar for Doug Neiner dougneiner
66
8.5k
Gemini Prompt Engineering: Practical Techniques for Tangible AI Outcomes
Avatar for Mfonobong Umondia mfonobong
2
420
Winning Ecommerce Organic Search in an AI Era - #searchnstuff2025
Avatar for Aleyda Solis aleyda
1
2k
Organizational Design Perspectives: An Ontology of Organizational Design Elements
Avatar for Dr. Kim W Petersen kimpetersen
PRO
1
720
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1370
210k
How To Speak Unicorn (iThemes Webinar)
Avatar for Michelle Schulp Hunt marktimemedia
1
470
Reflections from 52 weeks, 52 projects
Avatar for Jefferson Lam jeffersonlam
356
21k
AI: The stuff that nobody shows you
Avatar for John Nunemaker jnunemaker
PRO
8
680
For a Future-Friendly Web
Avatar for Brad Frost brad_frost
183
10k
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
413
23k
We Have a Design System, Now What?
Avatar for Morgane Peng morganepeng
55
8.2k
A brief & incomplete history of 
UX Design for the World Wide Web: 1989–2019
Avatar for Jason CranfordTeague jct
2
390

Transcript

  1. None

  2. Richard Fan Understanding the Identity of a CI Platform

  3. Who am I • Security Engineer • AWS Security Hero

    • Amateur hacker OSCP – but forgot how to try harder • Love travel, hiking • Have a cat

  4. Who am I • 10 Nov, 2024 @Brian Head

  5. (Refresher) Fulcio

  6. (Refresher) Fulcio

  7. Reusing other’s identity

  8. Victim? … argo-cd

  9. Victim? … argo-cd Pass the check!!!

  10. Check more extension --certificate-github-workflow-repository "argoproj/argo-cd"

  11. Extension verification support Not Supported Only for GitHub New OID

    scheme • sigstore-js (Was supported, but removed) • sigstore-rs (No stable release yet) • sigstore-ruby (No stable release yet) • policy-controller (Possible with attestation) • sigstore-python (CLI) • cosign • sigstore-java (With some tricks) • sigstore-python (API) • sigstore-go (Undocumented function) NewCertificateIdentity()

  12. No one size fit all

  13. No one size fit all GitHub GitLab

  14. No one size fit all If you think some mapping

    is not right? Raise a PR!! https://github.com/sigstore/fulcio/blob/main/config/identity/config.yaml

  15. How to find me [email protected] richardfan1126 @richardfan1126