Building Secure Package Pipelines
summary
A concrete blueprint shows how to eliminate long‑lived secrets with OIDC authentication, generate automated SBOMs per release, produce signed build attestations (SLSA provenance) linked to commit IDs, and run matrix CI across platforms. It pins GitHub Action hashes and tightens permissions, uses Dependabot/Renovate and Release Please for automated updates/releases, and scans with CodeQL. Consumers verify artifacts via GitHub CLI, reducing compromised dependencies, supply‑chain injections and manual release errors.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:17Securing build and test
- 7:53Vulnerable dependencies with Dependabot
- 8:56Attesting builds with in-toto and SLSA
- 11:46Software Bill of Materials for publishing
- 13:15OIDC for secure tokens
- 16:50Restricting access with GitHub environments
- 18:13Verifying packages
- 19:19Zero-trust package pipeline
- 20:45Tools and takeaways
- 21:54Everyone’s role in trust
related talks
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
23mMastering Secure Software Supply Chains
29mReducing the "Oops Factor": Pipelines for a Secure Python Development Lifecycle
54mFrom "Trust Me" to "Verify Me"
37mA Secure Continuous Delivery Pipeline
41mBeyond Guidelines - Designing & Implementing Robust Build Pipelines
26mLeveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
38mSecuring your CI/CD Pipeline