Secure your software supply chain from dependencies to deployment
summary
Claims that Google Cloud maps an end to end path and demos concrete controls: signing container images with cosign backed by GCP KMS, pushing signatures into an artifact registry, verifying at deploy time with a Kubernetes admission policy, and generating SBOMs for inventory. Cites studies: Sonatype shows large OSS attack growth and a prediction that ~45% of organizations face supply chain attacks by 2025. Mentions SLSA/Salsa levels as checklistable build guarantees.
AI-written summary · about
chapters (5)
- 0:00Software supply chain security intro
- 12:34Shift left and zero trust
- 14:41Sigstore and SLSA overview
- 23:21Cosign demo: image signing
- 32:35Q&A on SBOM and licenses
related talks
35mPractical Guides for Enhancing Your Software Supply Chain Security
40mPractical guides for enhacing your Software Supply Chain Security
41mSoftware Delivery Shield: securing the serverless software supply chain
34mFrom development to release: Protecting the software supply chain
32mSoftware Supply Chain Security
49mSecure Your Software Supply Chain with SLSA, Sigstore and Kyverno
44mImproving the Software Supply Chain Security
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?