Reimagining Trust in Software Releases: A New Approach to Supply Chain Integrity (Part 2)
summary
JFrog attaches cryptographic evidence to artifacts and ingests GitHub attestations so build provenance attestations travel with Docker images; Sonar quality gates and ServiceNow change approvals also become signed evidence. A new OPA-powered unified policy engine enforces gates that can warn, block promotions or require ServiceNow approval; demo shows automatic creation of a ServiceNow change, AI risk summary, manual approval writing back a signed artifact evidence, and a failed release blocked from production when a critical CVE is present.
AI-written summary · about
chapters (6)
- 0:00The role of evidence
- 2:01GitHub and JFrog integration
- 8:41Expanding ecosystem partnerships
- 12:28Unified policy engine
- 17:38ServiceNow integration demo
- 30:17Closing and recap
related talks
32mFrom Code to Trusted Release
12mSolving the AI Accountability Crisis in the Software Supply Chain
23mMastering Secure Software Supply Chains
54mFrom "Trust Me" to "Verify Me"
35mAchieving End-To-End Software Supply Chain Security With in-toto
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
44mSecuring the Supply Chain for Your Java Applications