Supple Supply Chain Security With kpack!
summary
Shows how to get reproducible container builds that emit an SBOM per build layer, apply SLSA-level checks, and produce cosign-signed provenance so you can verify who built each artifact. Uses buildpacks to generate SBOMs, runs builds inside Kubernetes via kpack on Kubernetes, and keeps images up to date in a remote cluster. Demo claims these components integrate to produce hermetic, parameterless builds and signed images with verifiable provenance.
AI-written summary · about
related talks
34mMake the Secure Kubernetes Supply Chain Work for You
31mBuildpacks: Pragmatic Solutions To Quick and Secure Image Builds
50mSupply Chain Security for Cloud Native Java.
05mLightning Talk: Scaling Container Builds with Software Supply Chains
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
30mNo Joker in the Pack: SBoMs for Container Images
36mEnforcing a Secure Supply Chain on Kubernetes
37mSupply Chain Security in Kubernetes