Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
summary
Introduces SLSA (Supply-chain Levels for Software Artifacts) and Sigstore as complementary open-source tools to secure software supply chains by verifying authenticity and integrity of dependencies and build artifacts. Explains how SLSA provides progressive security practices for build pipelines, how Sigstore enables transparent signing and attestation of artifacts, and concludes with a Kyverno demo showing how to enforce protections for Kubernetes deployments.
AI-written summary · about
chapters (8)
- 0:00Supply chain security
- 3:24Secure software supply chain
- 12:20SLSA pillars and compliance
- 20:51Sigstore: code signing
- 26:12Sigstore demo with cosign
- 33:29SLSA 3 container with GitHub Actions
- 43:01Validate artifacts with Kyverno
- 46:02Q&A
related talks
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
36mSecure Software Supply Chain for OCI Artifacts on Kubernetes
33mSLSA FRSCA Recipe For Secure Supply Chain
35mPractical Guides for Enhancing Your Software Supply Chain Security
34mProtect your software supply chain with Tekton and Sigstore
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
34mFrom development to release: Protecting the software supply chain