How to Secure Your Supply Chain at Scale
summary
Yahoo describes a concrete pipeline: Screwdriver produces builds and sends provenance into Grafeas, images get SBoMs and vulnerability data, signatures use Sigstore/cosign, and deployment-time webhooks (Kyverno + company checks) validate provenance, signatures and freshness. At Yahoo scale — ~60,000 build jobs, ~5,000 images/day, ~700 clusters — policies reject unsigned images, reject artifacts from forked or missing provenance, block images older than six months, and consult vulnerability metadata before allowing deploy.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:27What is the problem?
- 6:25Choose your battles wisely
- 7:14Existing security controls
- 8:36Software Composition Analysis (SCA)
- 9:56Build time vuln assessment
- 13:15Demo: provenance check
- 15:44Image signature check
- 16:36Demo: signature check
- 17:37Image freshness check
- 18:32Demo: freshness check
- 19:38More deployment verifications
- 22:17Lessons learned
related talks
28mBuilding Images for the Secure Supply Chain
33mWhat is the secure software supply chain
41mHow to protect your CI/CD from a Supply chain attack?
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
32mSoftware Supply Chain Security
23mMastering Secure Software Supply Chains
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
38mSecuring the chains: Building defensive layers for software supply chains