Supply Chain Security Reference Architecture
summary
Roadmap-style reference architecture that implements the CNCF white paper’s over 50 recommendations by defining components, interactions, and concrete tool mappings focused on the build pipeline phase. It maps theoretical controls to real software like tecton, in-toto, s-bomb, spiffy and covers signing, key management, provenance and attestations. The project includes sample code and tutorials, is chaired and contributed to by large vendors (VMware, IBM, Google, etc.), and publishes a public draft around KubeCon as a living document.
AI-written summary · about
chapters (5)
- 0:00Start
- 2:22What is the reference architecture?
- 3:53What does it cover?
- 6:24Who is working on it?
- 7:49What else can we look for from the STAG?
related talks
49mWhy Having a Security Reference Architecture Matters!
32mSoftware Supply Chain Security
35mUsing CNCF Best Practices for Software Supply Chain to Guide and Enha...
38mSecuring Your Supply Chain by Building with FRSCA
24mProtecting Ourselves from CNCFgate. Software Supply Cha...
33mChain Reaction: Remixing CNCF’s Supply Chain Security Guide for 2025
25mLet’s Talk Software Supply Chains with TAG Security
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects