Building Trust Through Proactive Security - Key Parts of the Trus...
summary
Red Hat claims that shifting security left and producing cryptographically-signed provenance and SBOMs inside an open-source pipeline actually reduces risk; the demo shows Conflux running on KIND, generating attestations, enforcing four policies (A–D) and blocking builds whose base image or CVE criteria fail. A hermetic build mode requires pre-fetched digests so hermetic builds expose every dependency and prevent curl‑pipe supply chain attacks, although a curl version mismatch let one demo pass. Pipeline meets Salsa build level 3 and RHEL10 scans showed 2,100 RPMs produced ~86,000 SAST findings with >80% false positives.
AI-written summary · about
chapters (16)
- 0:00Proactive security in supply chains
- 1:24Defining trust in software
- 3:12Proactive vs reactive security
- 6:21Secure development lifecycle
- 7:25Red Hat’s supply chain security
- 8:07Conflux pipeline overview
- 10:57Demo setup and policy enforcement
- 14:46Conflux UI and build monitoring
- 17:35Component one analysis and CVE scanning
- 19:40Component two curl vulnerability
- 23:23Component three hermetic builds
- 27:58Trusted artifacts and source mirroring
- 29:00Attestation inspection with cosign tree
- 30:24Proactive vulnerability management
- 34:18AI-enhanced CVE prioritization
- 37:55Q&A
related talks
27mBuilding Trust Through Proactive Security - Key Parts of the Trusted Software Supply Chain
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
45mSponsored Session: Because Security Matters: Securing Your Open Source Supply Chain
30mHow Secure Is Your Build/Server?
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
28mBuilding Images for the Secure Supply Chain
26mBuilding and Verifying Security Trust in Today’s Complex Tech Stacks ...
48mImplement ZeroTrust with Dedicated DevSecOps Pipeline