An OSS project's attempt to secure it's supply chain
summary
Jenkins X builds SBOMs with Syft, scans them with Grype, and starts signing binaries and SBOMs with Cosign while moving to keyless signing and Tekton Chains for provenance and in-toto attestations. The build now reports Go version, branch and commit; container images shrink from 1.8GB to 204MB after trimming dependencies. SPDX output lacks license metadata and Syft misses SPDX 2.3 so evaluation of alternate SBOM tools (Ko, ORY/ApkO) is ongoing. Next steps: sign Helm charts and modules and enforce cluster admission policies for unsigned artifacts.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 2:52Project goals and challenges
- 4:38Initial security gaps identified
- 6:46Adopting SBOMs with Syft
- 10:23Issues with Syft and license data
- 12:09Signing artifacts and binaries
- 13:35Provenance and attestation formats
- 17:03Current signing and SBOM workflow
- 18:50Next steps and future plans
- 20:14Conclusion and acknowledgments
related talks
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs
37mSecuring OSS across the whole supply chain and beyond
36mSBOMs, VEX, and Kubernetes
28mLeverage Kubernetes SPDX Tools to Create Your SBOM
23mSupply Chain Security using Free and Open Tools
35mTransforming SBOMs from Compliance Burden to Security Asset
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
34mSo, SBOMs Matter…Now What?