Building Images for the Secure Supply Chain
summary
Argues that supply-chain security needs provenance, reproducibility and smaller images, and demonstrates tooling that actually delivers those things: uses cosign keyless signing with GitHub OIDC to attach signatures to image digests (demo hits a cache/digest quirk), builds minimal images with apko reproducible builds and generates SBOMs, and shows scans where nginx Debian image has ~143 deps and 94 issues versus Alpine 43 deps and 2 issues and a Chainguard-built image with 46 deps and zero vulnerable packages. Mentions VEX as a way to cut scanner noise.
AI-written summary · about
chapters (4)
related talks
37mSupply Chain Security in Kubernetes
33mBuilding Images For The Secure Supply Chain
38mSecuring the chains: Building defensive layers for software supply chains
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
35mThe State of Your Supply Chain
20mGetting Started with Supply Chain Security is Easier Than You...
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
06mRethinking the Software Supply Chain: Trust, Minimalism, and Resili...