Policy-Driven Supply Chain Security with Enterprise Contract
summary
Enterprise Contract runs a policy engine that verifies container images’ signatures and attestations and gates releases; the demo uses cosign (both key and keyless via cosign keyless), validates SLSA provenance attestations, and emits human- and machine-readable reports (text and YAML). A golden image and three distinct image digests pass EC’s built‑in checks plus a Salsa source control policy (six successes reported), a GitHub OIDC-signed image passes subject/ref checks, and a deliberately mismatched policy produces a clear failure.
AI-written summary · about
chapters (16)
- 0:00Supply chain security threats
- 2:06Cryptographic signing for provenance
- 3:49Sigstore and Cosign simplifying
- 5:12SLSA guidelines and Conflux
- 6:15Enterprise Contract final gate
- 7:20Demo overview and Cosign verification
- 9:50Enterprise Contract image validation
- 10:55Enforcing SLSA policies
- 12:41YAML reports for policy checks
- 14:10Validating multiple images
- 15:47Q&A: Cosign vs Enterprise Contract
- 22:01Enterprise Contract with GitHub Actions
- 25:59Policy failure debugging
- 27:22Custom policy rules with Rego
- 28:54Open source project overview
- 29:35Q&A: Image analysis and workflow
related talks
21mEnforcing Organization Policies with Enterprise Contract
35mEnforcing a Secure Supply Chain on Kubernetes
35mPractical Guides for Enhancing Your Software Supply Chain Security
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
40mEnforcing a Secure Supply Chain on Kubernetes
48mContainer Security: It’s All About the Supply Chain
20mGetting Started with Supply Chain Security is Easier Than You...
36mEnforcing a Secure Supply Chain on Kubernetes