Securing the Supply Chain for Your Java Applications
summary
Every Git commit can be spoofed because Git trusts local metadata; demo shows a commit appearing as someone else and then enforces signed git commits to make the audit trail authentic. Builds produce CycloneDX SBOMs via Gradle/Maven plugins so dependency graphs and hashes are exact, scanned by Trivy and pushed into Dependency-Track for triage. Container images are built reproducibly with Cloud Native Buildpacks, cosign keyless signing registers signatures in Sigstore and GitHub generates SLSA provenance that can be policy-verified in Kubernetes with Kyverno.
AI-written summary · about
chapters (10)
- 0:00Software supply chain security
- 3:12Git signatures for source code
- 10:59Dependencies and SBOMs in Java
- 21:30SBOMs for vulnerability scanning
- 27:51False positives in reports
- 28:11Secure Java artifacts with build tools
- 33:57Signing container images
- 37:05Provenance and SLSA framework
- 41:41Security practices and people
- 42:02Q&A
related talks
50mSupply Chain Security for Cloud Native Java.
35mAchieving End-To-End Software Supply Chain Security With in-toto
36mSecure your software supply chain from dependencies to deployment
29mState of the secure software supply chain
23mMastering Secure Software Supply Chains
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
57mThe Secure Software Supply Chain
39mReflections on Trust in the Software Supply Chain