diff --git a/content/summit2026/_index.html b/content/summit2026/_index.html index 8838eb5..df080da 100644 --- a/content/summit2026/_index.html +++ b/content/summit2026/_index.html @@ -34,7 +34,7 @@

Key Information

Call for Presentations

- The Call for Presentations is now open! Please submit your proposals using the CFP form. + The CFP is now closed. Talks that have been accepted can be seen here.

Timeline

diff --git a/content/summit2026/confirmed-talks.html b/content/summit2026/confirmed-talks.html new file mode 100644 index 0000000..6fdcf28 --- /dev/null +++ b/content/summit2026/confirmed-talks.html @@ -0,0 +1,44 @@ +--- +url: /summit2026/talks +layout: index +title: "Transparency.dev Summit 2026 Confirmed Talks" +description: "Talks that have been confirmed for the Transparency.dev Summit 2026" +--- +
+

+
Transparency.dev Summit
+ Confirmed Talks +

+
+
+ + + + + + + + + + + + + + + +
+ Matthew McPherrin + + How Let's Encrypt is deploying Merkle Tree Certificates +
+ Hayden Blauzvern + + Simplicity through Transparency: How the PQC Migration is Streamlining Sigstore +
+ Ben Birt + + Git-ratchet: tooling for Git commit transparency +
+
+
+
diff --git a/content/summit2026/talks/git-ratchet.md b/content/summit2026/talks/git-ratchet.md new file mode 100644 index 0000000..d673270 --- /dev/null +++ b/content/summit2026/talks/git-ratchet.md @@ -0,0 +1,33 @@ +--- +url: summit2026/talks/git-ratchet.html +layout: summittalk +title: "Git-ratchet: tooling for Git commit transparency" +topImage: +type: +room: +start: +speaker: Ben Birt +speakerTitle: +--- + +
+ +Dependents of Git repositories often depend directly on a +branch or tag. Unfortunately, without taking further precautions, this +exposes those dependents to attack by any party authorised to change the +target commits of those branches or tags. Worse, those attacks can then be +hidden by scrubbing the evidence - by repointing the branch or tag back to +a legitimate commit. Git-ratchet is a tool which dependents can use to +enforce that upstream Git repository owners are transparent about their +branch and tag state (and how it evolves over time) - and it uses witnesses +to prevent split-view attacks on that commit transparency. + +--- + +### Speaker + +Ben is a software engineer on Google's Oak team. He is part +of the group that launched Google's new Private AI Compute (PAIC) platform +and most recently set up PAIC's new Tessera-based binary transparency log. + +
diff --git a/content/summit2026/talks/le-mtcs.md b/content/summit2026/talks/le-mtcs.md new file mode 100644 index 0000000..b88ae70 --- /dev/null +++ b/content/summit2026/talks/le-mtcs.md @@ -0,0 +1,30 @@ +--- +url: summit2026/talks/le-mtcs.html +layout: summittalk +title: "How Let's Encrypt is deploying Merkle Tree Certificates" +topImage: +type: +room: +start: +speaker: Matthew McPherrin +speakerTitle: +--- + +
+ +Let's Encrypt is working on launching Merkle Tree Certificates. In this talk, +we'll discuss how we've added Merkle Tree certificates to our Boulder CA +software, how we're serving our logs, and the testing, monitoring, and disaster +planning we're doing to ship a production-quality CA the world can rely on. +We'll compare running an MTCA and mirror to our previous ACME CA and static CT +logs, and what lessons from the past have informed our future architecture. + +--- + +### Speaker + +Matthew McPherrin is the technical lead of the Let's Encrypt site reliability +engineering team, which runs the Let’s Encrypt Certificate Authority and +Certificate Transparency logs. + +
diff --git a/content/summit2026/talks/sigstore.md b/content/summit2026/talks/sigstore.md new file mode 100644 index 0000000..0db233d --- /dev/null +++ b/content/summit2026/talks/sigstore.md @@ -0,0 +1,43 @@ +--- +url: summit2026/talks/sigstore.html +layout: summittalk +title: "Simplicity through Transparency: How the PQC Migration is Streamlining Sigstore" +topImage: +type: +room: +start: +speaker: Hayden Blauzvern +speakerTitle: +--- + +
+ +The transition to post-quantum cryptography is an emerging necessity, but +PQC algorithms like ML-DSA introduce a significant hurdle for signing: keys +and signatures are orders of magnitude larger, ballooning metadata, egress +and storage costs for transparency ecosystems. + +In this talk, we present the design for PQC for Sigstore, showing how +migrating to quantum-resistant algorithms is a greenfield opportunity to +drastically simplify artifact signing and verification with Sigstore. +Instead of just swapping out classical algorithms, we leveraged this unique +opportunity to revisit the system architecture and focus the design around +the transparency log as the primary enabler of simplicity and auditability. + +Sigstore will provide "keyless" identity-bound signatures rooted in +transparency. We'll explore how this shift shrinks verification metadata +down to just a signed checkpoint while still preserving Sigstore's security +and threat models. Finally, we will discuss how a new leaf format elegantly +solves PQC signing algorithm storage overhead while concurrently preventing +log poisoning and preserving user privacy. + +--- + +### Speaker + +Hayden Blauzvern is a technical lead on Google’s Open Source Security +Team, focused on making open-source software supply chain more secure and +auditable. Hayden is a maintainer and the community chair on the Sigstore +project. + +