Getting Started with Supply Chain Security is Easier Than You...
summary
Claims that getting started is practical: a demo builds a Rust Hello World with Kaniko, emits a CycloneDX SBOM, attaches Cosign signatures and Tekton Chains attestations, and enforces them via OPA Gatekeeper. A hijacked unsigned builder image slips past initial checks, then is caught after adding parent-image signature validation. The pipeline proves metadata living alongside images lets admission controllers block unsigned or unattested artifacts, and several enforcement features were added within weeks, showing rapid, usable progress.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:28Why Supply Chain Security
- 0:48Why Do We Care
- 2:03Getting Started
- 4:45Tools
- 6:36Sbomb
- 7:37Verification
- 8:29Metadata
- 8:50Admission Controller
- 9:29What Happened
- 11:11Building the Image
- 13:51Protecting Production
- 14:54Docker Pull
- 15:12Validation
- 15:51Running in Production
- 17:12Wrapping Up
- 18:58Production
related talks
28mBuilding Images for the Secure Supply Chain
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
35mPractical Guides for Enhancing Your Software Supply Chain Security
36mKubernetes Supply Chain Security: The Software Factory
32mSoftware Supply Chain Security
40mPractical guides for enhacing your Software Supply Chain Security
37mSecuring OSS across the whole supply chain and beyond
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security