Beyond Guidelines - Designing & Implementing Robust Build Pipelines
summary
Presents a concrete build pipeline implemented to meet FRSCA and CNCF/NIST guidance, running on Kubernetes with Tekton chains orchestration and CI, source analysis via SonarQube, container builds with Kaniko, SBOM generation by Syft and Grype, continuous vulnerability scanning, provenance generation and signed provenance stored to an internal metadata store. The pipeline handles Docker Hub rate limits by sharing pull credentials as Kubernetes secrets and successfully demonstrates end‑to‑end artifact creation, attestation and verification in a live demo.
AI-written summary · about
chapters (9)
- 0:00Robust build pipelines intro
- 1:25Security framework guidelines
- 8:41Secure pipeline requirements
- 12:02FESA framework implementation
- 16:38Pipeline architecture & tools
- 25:42Pipeline workflow demo
- 30:46Live pipeline demo
- 38:32Summary
- 39:25Q&A
related talks
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack
32mBuilding a Secure By-Design Pipeline with an Open Source Stack- 32mBuilding a Secure By-Design Pipeline with an Open Source Stack
19mWho Are You Building For: Pipelines Have a Purpose
38mSecuring Your Supply Chain by Building with FRSCA
27mAdventures in Production with GitOps, Secure Pipelines & Compliance - Brandon Lum & Ricardo Aravena
10mIt's Time We Start Securing Our CICD Pipelines
29mContinuous Integration and Continuous Delivery Pipelines: Just the Basics