Building Trust Through Proactive Security - Key Parts of the Trusted Software Supply Chain
summary
Red Hat describes an open-source build factory called Conflux built on Tekton that enforces supply‑chain controls, emits provenance and meets SLSA level 3 requirements; pipelines run SCA/SAST/malware scans, produce SBOM/CSAF/VEX metadata, and gate releases (example: a build is blocked for an unapproved base image, while a non‑blocking SCA CVE alert still allows release). A proof‑of‑concept combines SAST results with Red Hat CVE data and uses AI pattern analysis to surface repeating authorization weaknesses and prioritize remediation before release; the POC is promising but not yet in production.
AI-written summary · about
chapters (8)
- 0:00Proactive security intro
- 2:10Proactive vs reactive security
- 5:05Security in software supply chain
- 6:29Conflux pipeline for secure builds
- 8:36Policy validation and build gating
- 10:05Vulnerability management
- 13:22AI analysis of SAS and CVE data
- 17:14Q&A
related talks
43mBuilding Trust Through Proactive Security - Key Parts of the Trus...
38mSecuring Your Supply Chain by Building with FRSCA
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
36mKubernetes Supply Chain Security: The Software Factory
23mMastering Secure Software Supply Chains
39mReflections on Trust in the Software Supply Chain
30mSupply Chain Security for OpenSource Projects