Putting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
summary
An implementation of the CNCF Secure Software Factory that ties Tekton Chains, SPIRE identities, Sigstore and Kyverno to produce signed attestations and OCI-sidecar .att files; Tekton tasks emit SLSA-grade provenance, attestations are logged to Rekor or stored with images in registries, and policies deny artifacts missing SBOMs or signatures. Runtime visibility via eBPF/Falco detects anomalous build behavior, Q generates Tekton and Kyverno config from one spec, and short‑lived SPIRE keys limit blast radius while enabling automated promotion to production.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:25What is the Secure Software Factory
- 1:07What does the Secure Software Factory do
- 2:19Build Environment
- 7:21Example Build
- 8:47What is SFF
- 9:29SFF Defaults
- 11:18SFF Configuration
- 12:15SFF in Action
related talks
22mCloud Native Supply Chain Security with Tekton and Sigstore
33mSLSA FRSCA Recipe For Secure Supply Chain
34mProtect your software supply chain with Tekton and Sigstore
36mKubernetes Supply Chain Security: The Software Factory
38mSecuring Your Supply Chain by Building with FRSCA
36mSecure Software Supply Chain for OCI Artifacts on Kubernetes
23mSoftware Supply Chain Integrity with Sigstore
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE