Building Trust in Open Source: A Practical Guide to Securing Your ...
summary
Explains concrete steps: a demo Docker build and SBOM (SPDX/CycloneDX) generation, signing the image with Sigstore/cosign using OIDC and Rekor and verifying signatures, and enforcing deployment with a Kyverno policy that blocks unsigned images. Cites Gartner-style numbers — ~45% of orgs saw supply‑chain attacks and ~6% effectively mitigated them — and walks through real incidents (Lottie dependency theft, a PyPI “jar stealer”). Maps actions to SLSA levels 0–3 and shows the pipeline actually working end‑to‑end.
AI-written summary · about
chapters (18)
- 0:00Supply chain security risks
- 1:54Software supply chain security
- 4:03Supply chain attacks increasing
- 6:31Top four attack vectors
- 9:00Weak points in build pipeline
- 11:04Dependency poisoning attacks
- 14:14Backdoored utility software
- 14:35Securing software supply chains
- 15:18SALSA framework for builds
- 19:49SBOMs for dependency transparency
- 22:18Demo: SBOM for Docker image
- 27:17Sigstore for artifact provenance
- 30:47Demo: Signing container image
- 37:18Kyverno for signed image policies
- 40:30Security in CI/CD workflows
- 44:06Preventing supply chain attacks
- 46:34Security from first commit
- 46:55Resources and closing
related talks
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
35mPractical Guides for Enhancing Your Software Supply Chain Security
30mSecuring Open Source Supply Chains
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue
43mBuilding Trust Through Proactive Security - Key Parts of the Trus...
28mBuilding Images for the Secure Supply Chain
40mPractical guides for enhacing your Software Supply Chain Security
38mSecuring the chains: Building defensive layers for software supply chains