Deploying to production with confidence
summary
Left-pad unpublishing breaks 11,000 projects and Log4Shell still leaves vulnerable systems in 2025, so concrete controls are proposed: generate SBOMs (SPDX or CycloneDX) and meet US/EU requirements by end of 2026; adopt Sigstore keyless signing and provenance records; harden CI/CD with SLSA levels; produce reproducible builds and verify binaries with diffoscope and Reproducible Central. Use releasers (JReleaser or GoReleaser) to automate releases — thousands of snapshots and a two‑month cadence prove a one‑button release can build, sign and publish reliably in an hour.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:25Deployment disaster stories
- 5:45Testing in deployments
- 7:11Automating releases
- 9:00Publishing binaries
- 10:50Cross-language release tools
- 13:39Verifying binary authenticity
- 16:52Keyless signing with Sigstore
- 19:24Supply chain attack vectors
- 21:33SLSA framework levels
- 25:30Detecting vulnerable dependencies
- 29:26Software Bill of Materials
- 33:25Reproducible builds
- 36:39Steps for reproducible builds
- 41:21Security versus deadlines
- 43:30Open source contributions
- 45:39Summary and tools
- 46:28Q&A
related talks
45mDeploying to production with confidence
44mWhat does it take to deploy to production with confidence?
22mWhat does it take to deploy to production with confidence?
48mCRA, NIS2, DORA: What Senior Java Engineers Must Deliver Before 2027
23mBuilding Secure Package Pipelines
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue
23mMastering Secure Software Supply Chains
34mFrom development to release: Protecting the software supply chain