Enforcing Supply Chain Security and Simplifying Compliance Audit...
summary
Argoproj-level three builds (SLSA level 3) are the baseline and this work stitches together SLSA/SBOM provenance into ArgoCD deployments using Guac, Sigstore, in-toto, Elastic and Grafana to collect and query evidence. A DBOM (delivery bill of materials) aggregates signed build predicates and vulnerability feeds; an admission-controller or Argo interlace plugin can verify signatures at deploy time (argocd-interlace signs manifests but currently does not block failures). Remaining gaps: proving pen tests and build-system provenance and standardizing event traces; the team builds a virtual data layer to enforce policies.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:25Supply Chain Security
- 4:12Architecture
- 4:46Policies
- 5:20Go Delivery
- 7:04Tools
- 8:20Salsa
- 10:00Data Management
- 14:44Argo Interlace
- 16:50Wrap Up
related talks
22mGuardians of Code: Continuously Monitoring Security and DevOps Compliance
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
11mOSS Supply Chain Security
35mHow To Build Production Grade DevOps Platform Using Argoproj
23mMastering Secure Software Supply Chains
35mPractical Guides for Enhancing Your Software Supply Chain Security
23mA Practical Guide to ArgoCD Security Gating
44mImproving the Software Supply Chain Security