Securing Software Supply Chains for the Public Good
summary
A CNCF public sector white paper lays out a deployable architecture that uses OCI-compliant registries to store artifacts, pushes sbombs and attestations into a shared attestation store (archavista), and recommends in-toto/SALSA-style provenance plus commit-hash pinning to prevent typo squats and CI supply‑chain tampering. Implementation uses free OSS (GitHub Actions for SLSA attestations, runners for salsa provenance, Trivy and snick for scanning, OPA/policy controller for enforcement), reduces redundant storage across agencies, and provides an adoption roadmap for integration and verification.
AI-written summary · about
chapters (7)
- 0:00Software supply chains intro
- 3:53Why supply chain security matters
- 7:29Public sector supply chain challenges
- 11:03CNCF architecture overview
- 15:16Open source compliance tools
- 18:07Joining public sector user group
- 20:17Q&A
related talks
23mMastering Secure Software Supply Chains
37mSecuring OSS across the whole supply chain and beyond
43mThe Chain of Command: Building Trust Across Public Sector Software Pipelines
30mSecuring Open Source Supply Chains
14mKeynote: The Next Steps in Software Supply Chain Security
32mSoftware Supply Chain Security
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
36mSecure your software supply chain from dependencies to deployment