Supply Chain Security for Cloud Native Java.
summary
Shows a concrete Java 17 Spring Boot app built with Gradle, containerized using Cloud Native Buildpacks via the pack CLI and Paketo builders, and deployed to Kubernetes with signatures and policy checks. Generates SBOMs during build (syft), finds differing results from scanners—Grype reports 35 vulnerabilities while Trivy reports 34—and demonstrates ignoring a false positive. Uses GitHub Actions for reproducible builds (fixed timestamp), signs images and provenance with Sigstore / cosign, and enforces deployment blocking when signatures or attestations are missing.
AI-written summary · about
chapters (14)
- 0:00Introduction and overview
- 3:37Creating a baseline app
- 7:09Containerization with Buildpacks
- 14:35Supply chain security stages
- 15:16Securing source code
- 19:04Software bill of materials
- 24:27Vulnerability scanning challenges
- 31:41Automating with GitHub Actions
- 33:09Securing build pipelines
- 36:00Introducing SLSA framework
- 39:14Signing and attestation
- 41:22Verification in Kubernetes
- 44:17Kubernetes-native supply chains
- 48:12Conclusion and resources
related talks
44mSecuring the Supply Chain for Your Java Applications
05mSupple Supply Chain Security With kpack!
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
37mSupply Chain Security in Kubernetes
23mSupply Chain Security using Free and Open Tools
34mUntrusted Execution: Attacking the Cloud Native Supply Chain - Francesco Beltramini
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
36mSecure your software supply chain from dependencies to deployment