Policy control for Software Supply Chain
summary
Demo shows a concrete CI/CD flow that generates SBOM from image using Dagger and grype and calls an OPA HTTP API backed by Rego policies to block prohibited licenses and vulnerability levels, with exceptions allowed per policy. Enforces checks at CI, CD, and nightly scans, requires cryptographic attestations so builds prove origin, and recommends embedding SBOMs and attestations into images via OCI 1.1 so policy decisions travel with the artifact.
AI-written summary · about
chapters (7)
- 0:00Software supply chain risks
- 3:10Reactive dependency failures
- 5:19Policy enforcement demo
- 8:13CI/CD policy enforcement
- 9:58Open Policy Agent benefits
- 11:44Compliance and attestations
- 14:49Summary
related talks
45mSmarter Than Your Average SBOM!
37mSecuring OSS across the whole supply chain and beyond
29mMaking Software Bill of Materials (SBOMs) Actionable
38mSecuring the chains: Building defensive layers for software supply chains
35mPractical Guides for Enhancing Your Software Supply Chain Security
05mLightning Talk: A Secure Software Supply Chain for Open Policy Agency (OPA) Policies
33mAutomating Industry Regulation (SoX, SoC 2) Enforcement...
33mAutomation of SBOM Assessment in AGL Development Process