Software Delivery Shield: securing the serverless software supply chain
summary
Describes a concrete Google Cloud pipeline that produces and enforces machine-readable attestations for serverless delivery: Cloud Build emits SLSA level 3 attestations, Container Analysis scans images for CVEs, and an Assured Open Source repository provides vetted dependencies. Demonstrates building a Go container, using critis to evaluate vulnerability policies and sign images in Artifact Registry, then using Binary Authorization to block unsigned images from Cloud Run; shows one pipeline that signs and promotes automatically and another stricter policy that fails the build and prevents deployment.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:13Software supply chain security
- 6:30Demo goal and Cloud Run
- 8:37Cloud Workstation
- 14:21Secure pipeline with Cloud Build
- 18:54Demo 1: containerization and scanning
- 25:11Image signing and vulnerability checks
- 28:38Demo 2: end-to-end pipeline
- 39:45Summary
related talks
36mSecure your software supply chain from dependencies to deployment
59mIntroduction to SLSA
35mPractical Guides for Enhancing Your Software Supply Chain Security
34mFrom development to release: Protecting the software supply chain
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
29mMake Your CI More Secure and Less Spicy with SLSA
49mSecure Your Software Supply Chain with SLSA, Sigstore and Kyverno
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue