Beyond container image signing: How we enforce software supply chain policies at Datadog

Container image signing alone cannot detect compromises introduced before an image is built, such as poisoned dependencies or malicious source changes, necessitating a more comprehensive security approach. To solve this, Datadog created Turnstile, which generates cryptographically signed attestations for every stage of an artifact’s lifecycle and evaluates them against environment-specific policies during deployment. This system enables scalable, tamper-evident audit trails that verify whether an artifact satisfies specific security requirements beyond simple signature integrity checks.