Event Provenance Registry: Continuous Delivery Events for the Electric Sheep
summary
Event Provenance Registry is an open source, event-driven provenance service that records receipts in Postgres and publishes a single source of truth to Kafka so downstream scanners and deployers consume the same event. It supports CDEvents-based payloads and SBOM storage and retrieval, started internal development in 2019, reached production eight months after first commit, runs 24/7 with one recorded failure over years, has a Go core and a Python SDK and was later rewritten for clean OSS consumption.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:07Open source internal tools?
- 5:40Legacy CI/CD challenges
- 9:29Delaying open source
- 13:04Team growth and business logic
- 15:56Cleaning up or starting over
- 17:21Rebuilding registry
- 18:45Open source after five years
- 20:29Lessons learned
related talks
19mAdopting CDEvents and Embracing Interoperability
01h 04mCDEvents Project Summit
06mCDEvents Roadmap
32mAdopting CDEvents and Embracing Interoperability
23mUsing CD Events to Capture End to End Application Security Posture
08mBuilding a Future of Greater Interoperability in CI/CD with CDEvents
43mEvent Sourcing dealing with an eventful past
13mWhat’s new in CDEvents v0.4