Skip to content
MeetupIn personPast event

Beyond the Signature: Building ProvaValidator to Understand Container Trust

Event artwork for Beyond the Signature: Building ProvaValidator to Understand Container Trust

This event has ended

This listing is kept as an archive. Explore upcoming events to find your next one.

See upcoming events in Nottingham
About this event

What to expect

This Nottingham DevOps meetup explores the real-world challenges of container security through the lens of building ProvaValidator, an open-source security tool designed to answer a critical question: can we actually trust the container images we run in production?

What You'll Learn

The talk follows the complete journey of building ProvaValidator, from its origins as a simple provenance validator to its evolution into a comprehensive research platform for container trust verification. You'll discover how the tool handles:

  • Signature and attestation verification across different formats and standards
  • SBOM generation to understand what's actually inside your containers
  • Vulnerability scanning to identify security risks before deployment
  • Image drift detection to spot unauthorized changes
  • Trust signal comparison across major container registries

Using real-world research data, the session examines how container trust mechanisms work in practice, where they break down, and what distinguishes a merely signed image from a truly policy-ready one. This isn't theoretical security — it's based on practical experience analyzing images across production registries.

Engineering Deep Dive

Beyond the security concepts, you'll gain insights into the engineering challenges of building supply-chain security tooling, including:

  • Supporting multiple signing standards (Cosign and Notation)
  • Navigating registry access and authentication complexities
  • Scaling analysis across thousands of images
  • Translating supply-chain security theory into working, deployable software

Who Should Attend

This meetup is ideal for DevOps engineers, platform teams, security professionals, and anyone deploying containerized applications who wants to understand container trust beyond basic image signing. Whether you're implementing supply-chain security policies or simply curious about what makes a container trustworthy, you'll leave with practical knowledge and a clearer picture of the container security landscape.

The evening kicks off at 18:00 with doors open, the main talk begins at 18:30, followed by pizza and networking from 19:15. The venue is Fothergill House in central Nottingham, hosted by DevOps Notts and organized by Mica B.

Register for this event

Create With Conference · Brighton

The UK's leading event for AI builders.

600+ builders, honest implementation stories and hands-on workshops, once a year. The next edition is being planned.

The main stage at Create With 2026 with a full room
Hackathon participants with their laptops
A panel on the main stage

Running an AI event in Nottingham?

List it here, free.

Meetups, workshops and conferences go in front of thousands of builders after a quick review.

List your event