Securing the IaC Supply Chain

on YouTube ↗21m

" summary

Covers applying software supply-chain security practices (SLSA, Sigstore, in-toto) to Infrastructure-as-Code pipelines, focusing on design changes to Crossplane’s package management and its planned integration with Sigstore to provide provenance and attestations. Also includes a demo of an “admission control” style enforcement mechanism for IaC to illustrate how pipelines can reject or verify packages before deployment.

AI-written summary · about

" chapters (10)

1. 0:00Start
2. 0:27Introduction
3. 1:40Terms
4. 8:40Current Mitigations
5. 9:42Walled Garden!
6. 11:59Sigstore in one slide (cont.)
7. 14:25Life of a Sigstore Signature @ SigstoreCon
8. 14:48Sigstore for Crossplane
9. 15:54Slideware Demo
10. 18:58Call to Action

" related talks

• 35mPractical Guides for Enhancing Your Software Supply Chain SecurityAbdel Sghiouar · Voxxed Days Bucharest 2024
• 32mSoftware Supply Chain SecuritySantiago Torres-Arias, Kay Williams · Continuous Delivery Summit 2019 - San Diego
• 34mFrom development to release: Protecting the software supply chainLuca Bandini · devsecopsday 2023
• 23mMastering Secure Software Supply ChainsDasith Wijesiriwardena, Juan Burckhardt, Jason Goodsell · apidays Australia 2023
• 49mSecure Your Software Supply Chain with SLSA, Sigstore and KyvernoM. Abdennebi · Kubernetes Community Days France 2023
• 12mDevSecOps Playbook for AI-Era CI/CD PipelinesBhaskar Sawant · Conf42 DevOps 2026
• 36mSecure your software supply chain from dependencies to deploymentAbdellfetah Sghiouar · Øredev 2023
• 34mSecuring the Software Supply Chain with in-totoJustin Cappos, Santiago Torres-Arias · KubeCon + CloudNativeCon North America 2019