It's Time We Start Securing Our CICD Pipelines
summary
Claims a pipeline cannot be the root of trust and demonstrates concrete tooling: static signing of pipeline YAML, tasks and images with Sigstore/Cosign, provenance capture via Tekton Chains, and an admission controller that denies unsigned pipeline creation. Shows a three‑task example (Git Clone, Vulnerability Scan, Build Image) where a compromised Git Clone breaks downstream steps, demos tkn verify against a registry, and publishes open‑source code plus validators called pipe‑validate and pipe‑auditor.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 0:28CICD Pipeline
- 0:57CICD Pipeline Security
- 1:25Pipeline Lifecycle
- 6:58Pipeline Signing Utility
- 8:57Conclusion
related talks
26mProtect the Pipe! A Policy-based Approach for Securing CI/CD Pipe...
38mSecuring your CI/CD Pipeline
18mLet Devs Be Devs Without Sacrificing Security
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack
34mFrom Code to Deployment: A Deep Dive into Pipelines as Code
26mYour code might be secure, but what about your pipeline? ...
32mBuilding a Secure By-Design Pipeline with an Open Source Stack
37mA Secure Continuous Delivery Pipeline