Securing Your Supply Chain by Building with FRSCA
summary
FRSCA implements the Secure Software Factory reference architecture to enforce provenance, signatures, and SBOMs for builds, using Tekton and Tekton Chains, spiffe/spire for workload identity, HashiCorp Vault (transit) for signing, Tetragon for runtime visibility, and the Q language to generate and validate Kubernetes resources. A demo builds an image, emits .att and .sig plus an SBOM, and verifies the signature and SLSA provenance; pipelines are policy-driven so only approved, policy-compliant pipelines run.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:55Threats
- 4:20Provenance
- 4:50Pipeline Framework
- 8:54FRSCA
- 10:46FRSCA highlights
- 11:57FRSCA Architecture
- 15:26FRSCA Pipeline Framework
- 18:14What is Q
- 20:23Shared Responsibilities
- 22:21Pipelines
- 23:45Configuration
- 24:38Example Layout
- 25:26Demo
- 32:21Next Steps
- 33:14Additional Resources
related talks
33mSLSA FRSCA Recipe For Secure Supply Chain
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
27mBuilding Trust Through Proactive Security - Key Parts of the Trusted Software Supply Chain
34mProtect your software supply chain with Tekton and Sigstore
41mBeyond Guidelines - Designing & Implementing Robust Build Pipelines
32mSoftware Supply Chain Security
36mKubernetes Supply Chain Security: The Software Factory
23mMastering Secure Software Supply Chains