Secure Software Supply Chain for OCI Artifacts on Kubernetes
summary
The talk explains how to secure software supply chains for OCI container artifacts on Kubernetes using open-source tools: Sigstore for signing and verification, Kyverno for policy enforcement, and Syft/Grype for SBOM generation and vulnerability scanning. It covers what a secure supply chain is, why it matters, how to generate and verify SBOMs for OCI artifacts, and provides practical examples of implementing these tools together.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:48Software supply chain
- 3:13SLSA flaws
- 5:43Supply chain attacks growth
- 7:51Government software rules
- 10:43Trust and Ken Thompson
- 12:07OCI Images as vectors
- 13:12Trust model for artifacts
- 14:17Digital signatures for integrity
- 16:26Sigstore key management
- 17:53Democratizing signatures
- 18:34Attestation proof for chain
- 20:23Software Bill of Materials
- 21:28SBOM generation complexity
- 22:32Sign Docker image with Sigstore
- 26:51Generating SBOM
- 29:48Attach attestation to signed image
- 31:57Vulnerability analysis with SBOM
- 33:19Summary and next steps
- 34:48Q&A
related talks
49mSecure Your Software Supply Chain with SLSA, Sigstore and Kyverno
34mMake the Secure Kubernetes Supply Chain Work for You
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
36mEnforcing a Secure Supply Chain on Kubernetes
15mEnforcing a Secure Supply Chain on Kubernetes
36mKubernetes Supply Chain Security: The Software Factory
33mWhat is the secure software supply chain
35mEnforcing a Secure Supply Chain on Kubernetes