Implementing Zero Trust Security in Jenkins Pipelines With Open Source Tools
summary
Pipeline enforces concrete zero trust steps: run Mega Liner linting at PR and merge, build the artifact, generate SBOMs with Trivy or sift for repo and image layers, sign and immediately verify every SBOM and artifact with cosign, then push signed SBOMs and vulnerability reports into Ortilius for querying. The flow produces about six to ten artifacts (SBOM JSON, vuln JSON, signatures, artifact blobs) so production validates signatures and recomputes checks from those immutable records.
AI-written summary · about
chapters (9)
- 0:00Zero Trust in Jenkins
- 2:56What is Zero Trust
- 5:00Open source Zero Trust tools
- 8:50Developer duties in Zero Trust
- 11:18Integrating tools into pipelines
- 13:26Zero Trust pipeline steps
- 17:43Signing and verifying artifacts
- 19:11Ortelius data aggregation
- 19:32Q&A on Black Duck and Guac
related talks
10mIt's Time We Start Securing Our CICD Pipelines
32mHow to implement a DevSecOps pipeline with zero-trust
43mThe art of secure software: Zero-trust delivery pipelines
48mImplement ZeroTrust with Dedicated DevSecOps Pipeline
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack
32mBuilding a Secure By-Design Pipeline with an Open Source Stack
23mBuilding Secure Package Pipelines