Practical Guides for Enhancing Your Software Supply Chain Security
summary
Practical, hands on steps to secure CI/CD with concrete tools and checks are demonstrated including cosign image signing, SBOM generation (CycloneDX/SPDX), and verification via a Kubernetes admission controller that rejects unsigned images. SLSA levels map pipeline requirements; Prometheus and Argo are already SLSA level 3. Example shows an unsigned image failing policy and a signed image deploying successfully. Also covered: git sign for commit provenance, vulnerability scanning gates, and a curated set of ~200 assured open source packages.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:09What supply chain security means
- 2:11Why it matters now
- 3:56Supply chain attack consequences
- 8:51Common supply chain compromises
- 12:42Two approaches to secure supply chain
- 13:47SLSA framework introduction
- 17:15What is an SBOM and why it matters
- 19:42Demo: Securing container images with cosign
- 26:27Demo: Vulnerability scanning and trust verification
- 29:38Demo: Enforcing policies with admission controllers
- 32:29Free tools and resources
- 33:55Q&A
related talks
34mFrom development to release: Protecting the software supply chain
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
40mPractical guides for enhacing your Software Supply Chain Security
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
36mSecure your software supply chain from dependencies to deployment
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue