SLSA FRSCA Recipe For Secure Supply Chain
summary
Claims an end-to-end secure factory that reaches SLSA Level 3 by combining Tekton Pipelines/Chains, Sigstore/Cosign, SPIFFE/SPIRE, Kyverno, Tetragon, Vault and OCI metadata; demo shows a malicious mid-build image swap detected by Spire which invalidates the pipeline and prevents signing, and Kyverno blocks a manually built unsigned image from running in production. The system generates SBOMs and signed in‑pipeline and runtime attestations using short-lived certificates, and the demo proves the flow works.
AI-written summary · about
chapters (9)
- 0:00Start
- 4:56Components
- 8:41Build Environment
- 9:51Identity Services & Attestors
- 10:32Runtime & Admission Controller
- 11:24Metadata & Secret Store
- 11:56Configuration
- 12:36Trigger and Run
- 23:12Questions?
related talks
38mSecuring Your Supply Chain by Building with FRSCA
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
49mSecure Your Software Supply Chain with SLSA, Sigstore and Kyverno
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
34mProtect your software supply chain with Tekton and Sigstore
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge