JavaScript is not available.

. Formerly VMware, Google and Microsoft. Relapsing Container Image / Compiler Nerd.

chainguard.devJoined October 2017

864 Following

3,400 Followers

Matt Moore ⛓🚀’s Tweets

Pinned Tweet

Oct 7, 2021

This is gonna be fun!

Quote Tweet

Chainguard

Oct 7, 2021

We are thrilled to announce our new company: Chainguard, Inc. We are just getting started, but if you are interested in improving your software supply chain security, we would love to hear from you! chainguard.dev/posts/2021-10-

Please find me elsewhere, I am out of here for now.

524

I usually don't wear company swag, but when I do it's

! 😍 Thanks

No such luck, this is clearly something that GKE has installed as part of GMP. 🤦‍♂️ ... at least they found it...? 😬🌶️

In the "gmp-system" (aka Google Managed Prometheus) namespace is interesting. I know we launch kube-state-metrics here, so let's give GKE the benefit of the doubt here. So maaaaaaaybe this is something we decided to run (and can therefore fix!)... 🤞

Here's our top-level dashboard. Two concerns, in the one cluster we have it enabled on. However, configuration problems seems strange because we hadn't changed anything, so perhaps someone added something new with a bad configuration? Let's see which workload!

I went to check on our "GKE Security Posture" to see if it had found anything we could improve in our cluster. Turns out it had! A thread 🧵 SPOILERS: it is Google Managed Prometheus.

I'm gonna be in Raleigh November 27-29th, let me know if you want to talk OSS or supply chain security!

Just finished a super dope demo w/ chainguard images, signed w/ public

@projectsigstore

via

@tektoncd

chains & git commits signed via gitsign. With policy all enforced by

Add Buildkite OIDC to Fulcio by sj26 · Pull Request #890 · sigstore/fulcio

enforce for k8s and git. I'm thinking of making a stream for it. Sounds interesting to folks?

GIF

read image description

ALT

Whoa, looks like

is adding support for keyless signing to

@projectsigstore

! github.com/sigstore/fulci Welcome aboard!

github.com

Add Buildkite to the OIDC connect federation configuration. Fixes #889. Summary I'd like to be able to use Buildkite OIDC tokens to sign containers produced by my builds. There are more details...

TIL there's a website to inspect OCI image manifests: explore.ggcr.dev/?image=alpine: You can even navigate the layers and inspect the image filesystem interactively by clicking on the digest.

Why Distroless? Learning a lot from this event;

@erikaheidi

doing a great job of explaining Distroless image. crowdcast.io/c/wolfi-101

Chainguard

and erikaheidi@fosstodon.org

The meme streak continues!

Jonathan Yu @jawnsy@mastodon.social

Retweeted

@jawnsy

Nov 16

Really liking the

github.com/sigstore/cosig

distroless images: ✅ Support for amd64 and arm64 (and others) ✅ Lightweight/minimal (built with apko/melange) ✅ Rebuilt automatically every day (~0 CVEs) ✅ Signed with cosign ✅ Provided, in part, by some guy named Dan (👋

)

it's a shame HBO's Silicon Valley already ended

213

2,621

Nov 13

Jeanne just proposed something with “would it be bad if…” and I wholeheartedly blame

for this… 😂

Replying to

It's just bad hygiene!

Playing around with some more data on

images! Here are the package counts of our images compared to the standard ones. The Wolfi CVEs are all 0, but here's that graph too.

Nov 13

Roe v Wave

Quote Tweet

Tom Bonier

@tbonier

Roe Wave > Red Wave At this point, with a potential 1 seat gain for Dems in the Senate and the margin in the House likely to be no more than a few seats either way, it's safe to say that Dobbs changed everything. And this shouldn't have surprised anyone.

Show this thread

THE SENATE STAYS 🔵 This couldn’t happen without PA! Grateful for every vote, every donation, every phone call + door knock that got us here. 🥰 Now let’s finish the job by re-electing

@ReverendWarnock

on Dec. 6 so I can *officially* be your 51st vote 💯

4,673

17.4K

136K

Academy: Best place to learn about Software Supply Chain Security, and it is entirely free. edu.chainguard.dev

Pretty sure WeCrashed was on Apple+. We can save Alex’s new venture for season 3 (or 4).

Quote Tweet

Wall Street Memes

@wallstmemes

Netflix documentary producers watching this FTX shit unfold

Show this thread

CNCF TAG Security - R. Raccoon

Retweeted

@cncfsecurityTAG

Nov 10

Friendly reminder - CFP for #CNScon NA 2023 closes in 5 DAYS: Sunday, November 13 at 11:59pm PDT - Details on submission process can be found events.linuxfoundation.org/cloudnativesec.

events.linuxfoundation.org

Call For Proposals (CFP) | Linux Foundation Events

The KubeCon + CloudNativeCon North America 2020 Call for Proposals (CFP) is now closed. For any questions regarding the CFP process, please email cfp@cncf.io. KubeCon + CloudNativeCon brings together…

Twitter has peaked.

366

31.3K

335.5K

With it looking like GA is the deciding seat for the senate. Is anyone up for orchestrating a donation matching scheme like last time? Happy to help seed the matching pool. cc

Software Dark Matter is the Enemy of Software Transparency: chainguard.dev/unchained/soft If you want some real-world examples of things missed by scanners, try your scanner on the busybox, node, or wordpress images. Most scanners miss the primary app (busybox, node and wordpress).

chainguard.dev

Software Dark Matter is the Enemy of Software Transparency

Everything you need to know about securing the software supply chain.

Describe the state of OSS security in a phrase 🤗

Sets the bar high relative to proprietary software.

Quote Tweet

Chainguard

Securing the IaC Supply Chain - Jesse Sanford, Autodesk & Jason Hall,...

Describe the state of OSS security in a phrase

The

videos are up, including my talk with

about using

signing to secure

packages:

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kub...

what a difference a year makes thanks to

Quote Tweet

I think we would have avoided most of those supply chain attacks on npm if modules where signed. It’s called “web of trust”. I never understood why npm never implemented this.

who am i kidding i can never leave twitter

500

42.5K

408.9K

A wild

wolfi sighting in

golink! github.com/tailscale/goli