Be quiet. This is James Strong and Luis Denham Patty. What does Sarak have to do with Sixth
Store? Hello everyone. My name is James Strong and we're going to talk about rugby and Sixth
Store today. But something really interesting is happening today right now. So Seven Nations
started today and Wales and Ireland are playing. What's the score right now, Lewis? I think we
should concentrate on the talk. I think it would be most enjoyable. Last time we checked it was
327 in Ireland. Where are you from? Wales. Anyway, awesome. So I guess my name is James Strong. I'm
a solutions architect at Changar. I do a bunch of stuff with networking and Kubernetes. And if
you're here to win the book, meet me outside afterwards. If you sign a container image during
the talk and come hang out with me, I've got five copies of my book. So sign your container
images, everyone. And if I broke your Ingress Engine X release on Thursday, I apologize. Please
don't come outside and hang out with me. Hi, everyone. I'm Lewis. I'm similar to James in
Waze, not in others. As well as being at Changar, I'm the coach for Rebina Squirrels under eight
rugby team. That's why I'm listening today to a talk about six-door and rugby from myself. Yeah,
if you weren't mind keeping the score away from me with Wales versus Ireland right now,
that would be beneficial for my own sanity. Yes, next slide, please. So yeah,
at Changar, we support a lot of open source projects. We're talking today about six-door,
but we're also part of Salsa, doing some assessments for it. We've got Tecton, K-native,
OpenSSF, and Disturbance. Does anybody use any or all of those? I do. There's a couple
on there that aren't listed, like I said, Ingress Engine X. Changar supports me to support Ingress.
We also have our own container image out there. It's called Wolfie. You can check that out,
wolfie.dev. But like I said, we're going to talk about six-door and rugby today. Okay,
so who here has heard of six-door prior to walking into this room? Okay, we got a couple. Thank
you for coming. Who here has heard of rugby today prior to coming into this room? Yes,
hello. Right, so when we submitted this talk, James found this very special diagram, and when
we zoom in, we can see the similarities between six-door and rugby for this talk. Incidentally,
this lasts about 22 minutes, hence why we've had such a long introduction. So what do people think
rugby is? It's really not doing a haka. It looks cool and intimidates your opponents,
but that's not really what it is. It's a very difficult game with highly specialized positions,
and it was required to help everyone work together to achieve a goal, and that's really what we
think six-door is and what we want to talk about. So there's lots of components about it, and we
think that six-door is tackling supply chain security, and we're going to talk about how,
why, and hopefully make it fun along the way, and learn a little bit about rugby and six-door,
and probably a lot about neither. So why is six-door tackling supply chain security? It has
started to improve the supply chain technology that we all use. It's made by open-source
maintainers, for open-source maintainers. A lot of you may not be aware, but a lot of things are
being signed right now, so thank you to Adolfo there from SIG Release for signing all of the
Kubernetes releases with SIG Store. Thank you. It was a lot of hard work. I know PIPI, a lot of
package maintainers are going to be supporting that. I know that Maven, so there's a lot of people
that are using six-door. You might not even be aware that you're using it, but it's a direct
response to some of the challenges that are there right now. So who here has had someone else sign
their GPG key? Been through assigning parties, two, three people, four? Okay. I was really glad
not everyone shot their hand up because that would have been really fun. Anyway, we're going to talk
about how we're going to be doing that. So, again, not knowing where your software comes from, and
without having identity checks and safety protocols, it's leaving our, well, we're leaving it open to
explode some attacks. So, six-door attempts to make software and their infrastructure frictionless
and invisible. And as James just mentioned, we're integrated with a wide range of systems.
to an identity and know where it came from and who made that piece of software. And just like in
six-door, Rugby also has lots of positions that are available, highly specialized. I play a hooker,
that's much different than what a fullback would do. We all have different responsibilities to be
able to win the game. So we're going to tie those two together. I'm going to start off at the very
top of the play. So we're going to talk about trust routes. So with signing, we also require
trust. So knowing who is making available this piece of software. So think of it from a PKI
perspective. We have a route of trust in SSL certificates. What we're also trying to accomplish
with six-door is that same route of trust. So think of automated software for SSL certificates.
I was thinking of Johnny Sexton. Oh, Johnny Sexton. That's not the answer. But think of it from that
perspective. So six-door has a route of trust. It was initialized with TOF. So the update.
Let's Encrypt. Let's Encrypt. Thank you. Thank you for that. Let's Encrypt. Think about six-door as
Let's Encrypt for software signing artifacts, making it easy and transparent for everyone to use.
So the fly-half is very influential player on the field. And in order to start that route of trust,
we have to have that trust there. So there's a bunch of links there. We actually did a live stream
of the six-door key signing. If you want to figure out how they initialized that and did all that
work, that's a great YouTube video from that. So going from the fly-half to the loose-head,
from a play perspective, they're going to be the certificate authority. So now we've got our route
of trust. We have our certificate authority to be able to produce those certificates to sign those
artifacts. So a lot of responsibility is on the CA from that perspective. And of course, being a
loose-head, you carry a lot of weight on the team. You're very important into the scrum. So again,
very important position on the team. So OITC allows us to identify the end user. We obtain
some basic information about the user. And Falsio uses OITC to authenticate requests. Subject
related claims can be extracted and included on the certificate. Six-door runs a federated OITC
identity provider in DEX, which creates a DEX OITC token from the original OITC. Falsio supports
OITC from additional configured users. Issues, sorry, as we can see from the screenshot. And the
play that we selected for this was Martin Castro Giovanni. Does anyone know if Martin Castro
Giovanni? No. Okay, well, there's something learned today. He's a massive identity within the Italian
game, even though he's originally from Argentina. And the reason I selected him is because you can
identify him because of his sleeve with all the identities of his family members on his arm. Next
one. And so now we've come to Falsio. Falsio is the API that drives all of this, that ties the OITC
and the certificate authority together. So when you're making a request to get a signing certificate,
you're doing it through Falsio. And we put that together with the hooker. And yes, I was self-serving
that is me. And do feel sorry for that guy. So Falsio is a free code signing certificate
authority. Anyone can make a request to get a signing certificate, tie it to their identity,
and make it available for everyone to verify. They are short-lived certificates, so that's
going to come into play from another piece of technology perspective. We're going to talk a
little bit more about that with RECORE. So with RECORE, it provides a new ability with
ephemeral certificates. It's based on a Merkle tree, and it fulfills the transparency log,
which means that it's searchable for all. So you can use that URL there to be able to search
via a browser, or you can use RECORE CLI to be able to search. So for this one, I'm looking
towards Martin Johnson. Again, as a Welsh person, for putting all these names out, it's quite
difficult for me. But Martin Johnson was a powerhouse for England. He was a captain who
led them to numerous victories. But the reason why this is comparable to RECORE is he went
on to a successful coaching career as well, providing insights for the next generation
that has to hire to play the game. Yes, next slide, please.
So we want to take some time and talk a little bit about how a developer interacts with that.
So when we think about it from a rugby perspective, the scrum half is the connector between the
forwards and the backs from that perspective. And cosine is that glue that ties all of these
pieces together. Think of it like a QCTL, right? You don't actually directly interact
with the API. You do it through QCTL. Cosine is how you do that with Pulseo and RECORE
and the rest of the other six-door environments. So you can actually sign and verify signatures.
It also creates in-toto attestations. So if you wanted to generate and sign other metadata
about your container images, maybe how many CVEs are in it, if you're generating an S-Bomb,
things like that, other metadata, you can make available, sign it, and store it with
the container. All of that can be done through cosine. And we're not talking about just container
images as well. That's where it's highly targeted right now, but you can also sign other pieces
of information. So when I send, as for fun, when I send documents to clients nowadays,
I also sign it, and it generates the hash of the document and the signature, and they
know that that document came from me. So it's basically a free DocuSign.
So this is Gareth Edwards. He was an influential player in the 70s, played 88 consecutive games
for Wales, and one of the key reasons to our success in the 70s, not so much in the 2020s.
And yes, the Scrum half is instrumental in communicating between the backs and the forwards
within a game, which I can also see with Cosine. Not necessarily Cosine and Rugby, but yes,
the next slide.