Supply Chain Security Tooling
summary
Demonstrations use Sigstore components — cosign, fulcio, rekor — plus kind, Helm, Kyverno and GitHub Actions to build, sign and verify artifacts and commits. A container is built, cosigned, pushed and its signature plus SLSA provenance is stored in Rekor — that demo works. Kyverno blocks an unsigned pod and allows a signed one. A GitHub Action emits SLSA provenance (level 2/3) and cosign signatures automatically. Git commit signing via sigstore OIDC succeeds and Rekor records the entry.
AI-written summary · about
chapters (8)
- 0:00Introduction to supply chain security
- 17:30Understanding SLSA framework
- 27:00Sigstore and supply chain tooling
- 42:10Demo signing a container with cosign
- 52:03Enforcing policies with Kyverno
- 1:01:34Automating provenance with GitHub Actions
- 1:17:43Signing Git commits with sigstore
- 1:22:02Future of supply chain security
related talks
23mSoftware Supply Chain Integrity with Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
15mEnforcing a Secure Supply Chain on Kubernetes
40mSigstore: How We Started, Where We Are, Where We are Headed
40mEnforcing a Secure Supply Chain on Kubernetes
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
02h 45mSoftware Supply Chain Security with Sigstore
36mEnforcing a Secure Supply Chain on Kubernetes