Deploying to production with confidence
summary
Frequent supply-chain incidents (left‑pad five years ago, Log4Shell ~3 years, an XZ exploit recently) push a practical checklist: automate releases with tools like goreleaser or JReleaser, produce SBOMs (SPDX or CycloneDX) listing purls and hashes, sign artifacts via Sixto-style transparency logs, follow SLSA provenance levels (0–3) and enforce reproducible builds so binaries compare bit‑for‑bit (use defosscope for binary diffs); these steps detect or prevent tampered releases.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker intro
- 7:27Why deployments fail on Fridays
- 17:58Automating release pipelines
- 23:44Verifying binary authenticity
- 29:44SBOM and dependency security
- 34:26Reproducible builds
- 41:11Open source contributions and closing
related talks
49mDeploying to production with confidence
22mWhat does it take to deploy to production with confidence?
44mWhat does it take to deploy to production with confidence?
30mSupply Chain Security for OpenSource Projects
34mFrom development to release: Protecting the software supply chain
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue
23mMastering Secure Software Supply Chains
15mSoftware Supply Chain Security for those in a rush