Know Your Dependencies: A Guide to Automating Dependency Assurance
summary
Modern applications contain huge hidden trees of dependencies — one product examined has 1500 dependencies with only 30 direct — and roughly half of surveyed codebases show a high‑risk vulnerability or a license conflict. The concrete pipeline builds a trusted registry (Artifactory/Harbor), triggers Argo Workflows to generate CycloneDX s‑boms (via sift), merges image and source s‑boms, signs them with cosine, ingests into Dependency‑Track for vuln and license checks, surfaces results in Grafana/Neo4j, and gates deploys with Kyverno/Gatekeeper; it works but scales CPU/memory heavy and misses nonstandard installs.
AI-written summary · about
chapters (10)
- 0:00Dependency assurance intro
- 1:08Why dependencies matter
- 3:19Engineers lack dependency knowledge
- 5:09Benefits of dependency tracking
- 9:28Trusted image registry
- 10:32Automated security workflows
- 15:29Dependency dashboards
- 18:02Implementation lessons
- 20:51Key takeaways
- 21:59Q&A on scanning limits
related talks
46mSafely through the dependency minefield using OWASP Dependency Track
24mDependency Track Fortifying The Supply Chain
54mSupply Chain Sec /w Dependency Track
23mSupply Chain Security using Free and Open Tools
29mDependency Management: Where the Fork are We?
21mSecuring Diverse Supply Chains Across Interconnected Systems
37mKeep Your Dependencies in Check
25mFlagship Projects: Dependency Track