Mastering Secure Software Supply Chains
summary
Explains concrete steps: enable cryptographic commit signing and require verified commits, run SAST/DAST and secret scanning in CI, pin dependencies and generate an SBOM for every build, record provenance so builds list the exact agent and inputs, sign artifacts with cosign or Notation and store attested artifacts via ORAS in an OCI artifact registry, ingest into a quarantined store then UAT, run recurring scans with Trivy/Grype/Snyk or Defender, and enforce admission control with OPA/Gatekeeper or Ratify before production.
AI-written summary · about
chapters (7)
- 0:00Intro
- 1:22Supply Chain Threats
- 4:37Producer Focus
- 11:05Consumer Focus
- 17:44Vulnerability Scanning
- 19:15Last Line of Defence
- 21:15Summary
related talks
29mState of the secure software supply chain
37mSecuring OSS across the whole supply chain and beyond
32mSoftware Supply Chain Security
34mFrom development to release: Protecting the software supply chain
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
30mSupply Chain Security for OpenSource Projects
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
24mProtecting Ourselves from CNCFgate. Software Supply Cha...