Understanding the Identity of a CI Platform

Presented at SigstoreCon 2024

Transcript

2. Richard Fan Understanding the Identity of a CI Platform
3. Who am I • Security Engineer • AWS Security Hero • Amateur hacker OSCP – but forgot how to try harder • Love travel, hiking • Have a cat
4. Who am I • 10 Nov, 2024 @Brian Head
5. (Refresher) Fulcio
6. (Refresher) Fulcio
7. Reusing other’s identity
8. Victim? … argo-cd
9. Victim? … argo-cd Pass the check!!!
10. Check more extension --certificate-github-workflow-repository "argoproj/argo-cd"
11. Extension verification support Not Supported Only for GitHub New OID scheme • sigstore-js (Was supported, but removed) • sigstore-rs (No stable release yet) • sigstore-ruby (No stable release yet) • policy-controller (Possible with attestation) • sigstore-python (CLI) • cosign • sigstore-java (With some tricks) • sigstore-python (API) • sigstore-go (Undocumented function) NewCertificateIdentity()
12. No one size fit all
13. No one size fit all GitHub GitLab
14. No one size fit all If you think some mapping is not right? Raise a PR!! https://github.com/sigstore/fulcio/blob/main/config/identity/config.yaml
15. How to find me richardfan1126@gmail.com richardfan1126 @richardfan1126