Curating and Securing Open Source for the GovCloud
summary
Developers cut turnaround from days to hours by automating four pipelines: preparation workflow generates a JSON manifest of requested packages and transitive dependencies, curation workflow pulls from Maven/Docker hubs into a DMZ Artifactory and runs JFrog X‑Ray scans, then a bundle workflow creates a GPG‑signed release bundle, and a load workflow verifies signatures and populates the air‑gapped repo. Demonstration uses JFrog Artifactory, X‑Ray and Pipelines, handles offline distribution and blocks vulnerable packages discovered during scanning.
AI-written summary · about
chapters (8)
- 0:00Curating open source for GovCloud
- 1:08Classified software deployment challenges
- 6:31Software supply chain problem
- 11:50Automating curation workflows
- 15:48Secure artifact handling workflows
- 26:52Live demo: curation pipelines
- 33:08Runtime vulnerabilities and updates
- 36:28Q&A: notifications and CI/CD
related talks
32mFrom Code to Trusted Release
17mBuilding Secure Open Source Communities From the Ground Up
18mGlobal security at maximum velocity: Multi-Region and hybrid DevSecOps
01h 29mDevOps 101 Workshop
32mEasier, Faster, and Safer Open Source Consumption Governance
07mJFrog Sponsored Session - Narasimha Pai, JFrog
36mElevating Innovation: GitHub & JFrog Paving the Way Forward
32mFiring up a holistic Continuous Delivery Pipeline