Software Supply Chain Security
Talkat Continuous Delivery Summit 2019 - San Diego · on Monday, 2019-11-18· at 21:45· San Diego Convention Center - Room 1, 131 W Harbor Dr·
summary
Industry effort defines a concrete pipeline: producers publish artifact metadata into repositories, consumers enforce policies that check identities, hashes, build provenance and required approvals. They propose a standard software Bill of Materials format, metadata repos, and policy-driven verification. A live demo uses in-toto link metadata and a Kubernetes scanner (KubeSec/Cusack) to sign and verify layouts and attestations; verification succeeds. Integrations include Jenkins plugins, admission controllers and package/update systems.
AI-written summary · about
chapters (8)
- 0:00Introduction to speakers
- 1:29Key concepts overview
- 7:22User scenarios explained
- 13:52Demo of in-toto and cubeSeck
- 21:41In-toto pipeline walkthrough
- 27:21How to get involved today
- 28:25Industry collaboration timeline
- 30:11Q&A and wrap-up
related talks
23mMastering Secure Software Supply Chains
14mKeynote: The Next Steps in Software Supply Chain Security
33mWhat is the secure software supply chain
38mSecuring the chains: Building defensive layers for software supply chains
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
28mThe role of CDEs in securing your software supply chain
34mFrom development to release: Protecting the software supply chain
36mSecure your software supply chain from dependencies to deployment