Provenance Before Publish: Building Safer PowerShell and Chocolatey Pipelines
summary
Pipeline shows concrete checks: GitHub Actions run PSScriptAnalyzer and Semgrep and emit SARIF findings; Syft produces a CycloneDX SBOM that Grype scans for CVEs; provenance gets recorded as in-toto attestation signed and retained; Chocolatey prepublish steps enforce checksums and a Levenshtein similarity check against CCR names, validate verification.txt and install scripts, and warn on floating dependencies. Mean time to exploit drops from years to hours, so these forkable artifacts and signed receipts let teams prove what was built and when.
AI-written summary · about
chapters (9)
- 0:00Supply chain security risks
- 1:16Supply chain attacks 2024-2026
- 8:41Provenance for package security
- 12:55Supply chain attack types
- 21:44Pipeline compromise and secrets
- 29:06Software bill of materials
- 36:44Pipeline validation
- 44:05Adoption path for maintainers
- 47:35Q&A
related talks
48mStop Writing Insecure PowerShell... Seriously.
30mSecuring Open Source Supply Chains
44mSipping psake: Creating a Build and Release Pipeline for ...
23mBuilding Secure Package Pipelines
54mFrom "Trust Me" to "Verify Me"
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
58mSecuring your .NET application software supply chain
42mProtecting CI/CD from malicious deploys