Reimagining Trust in Software Releases: A New Approach to Supply Chain Integrity (Part 1)
summary
Demo shows JFrog App Trust as a new platform feature that links runtime detection to lifecycle enforcement: runtime security live assessment flags a critical CVE in pizza shop v415, owner finds the risk introducer, pizza checkout releases v416, lifecycle policies force tests and block an AI agent bypass, and production image shows no risk afterward. Setup uses an application key embedded in repos to auto-associate packages and trigger builds, exposing automated evidence-based policy controls and clear ownership.
AI-written summary · about
chapters (8)
- 0:00Introduction to supply chain trust
- 3:13Contrast with past vulnerabilities
- 8:10Modern vulnerability response demo
- 13:37Lifecycle management done right
- 14:43Introducing JG App Trust
- 15:48Building blocks of App Trust
- 16:51Application entity explained
- 17:57Demo setting up an application
related talks
32mFrom Code to Trusted Release
29mFrom Vulnerabilities to Vigilance
27mBuilding Trust Through Proactive Security - Key Parts of the Trusted Software Supply Chain
43mBuilding Trust Through Proactive Security - Key Parts of the Trus...
39mReflections on Trust in the Software Supply Chain
06mSponsored Keynote: Trust and Risk in the Software Supply Chain
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
36mBuilding a Trusted and Resilient Software Supply Chain