SLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
summary
Explains concrete defenses: use sigstore/cosign to sign container images (demo signs images with a KMS key and optional transparency log), attach and sign an SBOM (syft generates SPDX/CycloneDX), and enforce signatures in-cluster via a policy controller. Recommends aiming for SLSA level 3 builds (scripted, ephemeral workers, 18‑month commit history). Cites real failures — SolarWinds, CircleCI key leak, and a Swedish supermarket incident that closed 500+ stores — and notes EU rules forcing SBOMs by 2024/25.
AI-written summary · about
chapters (20)
- 0:00Intro
- 2:15Dependencies
- 3:35Backdoors
- 5:39Coupe example
- 9:07Internal malicious actors
- 12:04Shift Left Zero Trust
- 14:19SigStore
- 14:40OpenSSF
- 15:09Cosine
- 15:45SLSA
- 16:18SLSA Requirements
- 20:28SBOM
- 25:36SBOM example
- 29:58Generate SBOM
- 31:07Add SBOM to container
- 32:36Cosign Policy Controller
- 34:08Cloud Workstation
- 36:26Example
- 39:02Free Tools
- 40:56Questions
related talks
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
59mIntroduction to SLSA
49mSecure Your Software Supply Chain with SLSA, Sigstore and Kyverno
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue
37mSecuring OSS across the whole supply chain and beyond
35mPractical Guides for Enhancing Your Software Supply Chain Security
33mSLSA FRSCA Recipe For Secure Supply Chain