Beyond container image signing: How we enforce software supply chain policies at Datadog

Datadog developed Turnstile, an internal software supply-chain security system that extends container image signing by determining whether an artifact meets environment-specific deployment policies, rather than merely confirming it has not changed since signing. Built on adapted in-toto and SLSA concepts, it creates cryptographically signed attestations linking commits, pull requests, build provenance, SBOMs, vulnerability data, image signatures, and deployments, enabling deployed artifacts to be traced back through their lifecycle. Its dd-attest library uses ephemeral, identity-bound keys tied to workloads such as CI jobs and Kubernetes service accounts, avoiding widespread long-lived key management while allowing compromised producers to be revoked. At deployment time, policy-core retrieves and verifies attestations, evaluates Open Policy Agent policies, and records a signed verification summary that can support auditing, warnings, or deployment blocking. Turnstile distributes policies securely through The Update Framework, stores attestation data in DynamoDB, and uses caching to support high-volume deployment checks; in August 2026, it reported a 92.8% policy cache hit rate and median evaluation latency of 36 milliseconds across roughly one million traces.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.