Lightning Talk: A Secure Software Supply Chain for Open Policy Agency (OPA) Policies
summary
OPA policies are packaged, tagged and pushed as OCI artifacts using the policy CLI and an OPCR-compliant registry (examples: GHCR, Docker, AWS). Images are signed and verified with cosign, including publishing a public key file and verifying annotations, and the demo builds a hello-world Rego, produces an image, pushes to GHCR and successfully verifies the signature. OPA and Topaz can then natively pull policy bundles from OCI registries for deployment and admission control.
AI-written summary · about
