Our dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue
summary
Project supply chains are full of surprising failure modes: a backdoor in XZ, SolarWinds cascading to national infrastructure, and a Swedish supermarket outage that closes about 700 stores for days. The practical fixes shown are concrete: generate SBOMs (CycloneDX/SPDX via Syft), produce signatures with Cosign and Rekor (Fulcio issues certs), and meet SLSA level 3 practices (Prometheus and Argo are cited). Pipelines attach SBOMs and signatures to OCI images and Kubernetes policy controllers reject unsigned deployments. Start by signing images and running vulnerability scans.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 1:19What is software supply chain security
- 4:10Why supply chain security is scary
- 14:42Solving supply chain security issues
- 15:42Sigstore and its components
- 17:49SLSA framework explained
- 22:21Understanding SBOM and its importance
- 25:51Demo: Signing and verifying images
- 29:22Summary and key takeaways
- 30:07Q&A session
related talks
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
15mSoftware Supply Chain Security for those in a rush
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
39mOpen Source Software Supply Chain Security — Why does it matter?
30mSecuring Open Source Supply Chains
40mPractical guides for enhacing your Software Supply Chain Security
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond