How to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
summary
Shows how to secure a software supply chain to SLSA level 3 by building signed provenance with GitHub Actions reusable workflows as the trusted builder, using Sigstore (cosign and Rekor) to create short-lived certificates and SCTs so signatures stay verifiable after expiry, and enforcing deployment policies that require matching provenance digest, builder identity and source. Demonstrates policy enforcement end-to-end by blocking a manually-built image while allowing a CI-built image that passes Kyverno verify-slsa provenance checks.
AI-written summary · about
chapters (4)
related talks
49mSecure Your Software Supply Chain with SLSA, Sigstore and Kyverno
33mSLSA FRSCA Recipe For Secure Supply Chain
34mProtect your software supply chain with Tekton and Sigstore
36mSpicing up Container Image Security with SLSA & GUAC
40mSLSA with Us: The Dance of AppSec
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
30mSecuring Open Source Supply Chains