Scanning for FIPS : Building confidence in Compliance from the Container up
summary
Pipeline adds a post-build step that unpacks images with umoci and runs check-payload (scan-image/scan-local) to statically inspect ELF binaries, enforce dynamic linking and CGO-enabled Go builds, and emit JSON/CSV results. Results are policy-gated by Conforma/OPA inside a Tekton/Conflux pipeline so failures block release and notify teams. Uses FIPS-ready base images, does not replace CVE scanners, and currently does not perform PQC validation.
AI-written summary · about
chapters (12)
- 0:00FIPS compliance introduction
- 1:03Federal Information Processing Standards
- 4:18FIPS 140-2 and 140-3 standards
- 8:13FIPS terms and validation
- 11:06FIPS compliance for containers
- 11:50Open source FIPS tools
- 13:15Payload scans for container images
- 17:29Validating ELF binaries
- 18:52Go binaries in FIPS mode
- 20:39FIPS scanning in CI/CD
- 23:31FIPS compliance summary
- 24:35Q&A on FIPS integration
related talks
50mRuntime Security for Containers
32mA Security State Of Mind: Compliance and ...
30mAdventures in Production with GitOps, Secure Pipelines & Compliance
48mBuilding GDPR, ISO27001 Containerized Application for continuous compliance
34mUnpacking Open Source Security in Public Repos & Registries
30mMaster the Container Security Model with
41mBeyond Guidelines - Designing & Implementing Robust Build Pipelines
18mContinuous Security - Building Security into your Pipelines