Supply-chain concerns have recently escalated, impacting even code running on the mainframe. How can you ensure the code you're IPL'ing is the code you think it is? How do you trust service delivered from outside your data center? This presentation will explore code signing and chains of trust, specifically explaining two new features for z/VM. The first, Guest Secure IPL, validates the guest OS of the attempted boot. The second, Digital Signature Verification, provides authentication and integrity validation for downloaded service. We'll cover what this does and doesn't protect and discuss what the future may hold in this space.

Presented by Arielle Goldberg, Software Developer