Beyond the Signature: Building ProvaValidator to Understand Container Trust

Talk;

• This talk follows the journey of building ProvaValidator(https://github.com/KiptoonKipkurui/provavalidator), a container image security tool created to answer a practical question: can we actually trust the images we run? What began as a provenance validator evolved into a broader research platform for verifying signatures and attestations, generating SBOMs, scanning vulnerabilities, detecting image drift, and comparing image trust signals across major registries.

• Using real-world research data, the talk explores how container trust works in practice, where it breaks down, and what separates a signed image from a truly policy-ready one. It also covers the engineering lessons learned while building the tool, including support for Cosign and Notation, registry access challenges, scaling analysis across many images, and the operational realities of turning supply-chain security ideas into working software.

• Agenda;
  18:00; Doors Open
  18:30; Speaker delivers talk
  19:15; Pizza and catch up
  20:00; Doors close

Location; Fothergill House, 16 King St, Nottingham NG1 2AS