What does it take to deploy to production with confidence?
summary
Practical checklist for shipping with measurable trust: adopt reproducible builds using Maven or Gradle plugins so source-to-binary SHA matches, generate SBOMs (CycloneDX/SPDX) because governments now require them, follow SLSA provenance levels to attest build integrity, publish with JReleaser to automate artifacts, signatures and SBOMs, and use Sigstore/Fulcio for short‑lived key signing. Examples and tooling show these steps are feasible, reduce manual trust, and make Friday deployments less guesswork.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:07Confidence in production
- 3:13CD Foundation CI/CD best practices
- 5:46Repeatable vs reproducible builds
- 6:52Reproducible builds and trust
- 10:27Security threats in lifecycle
- 11:30SLSA for build integrity
- 13:17SBOM and supply chain
- 16:52SBOM challenges and solutions
- 18:21Secure release tools
- 20:54Change logs and communication
related talks
44mWhat does it take to deploy to production with confidence?
45mDeploying to production with confidence
49mDeploying to production with confidence
23mMastering Secure Software Supply Chains
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
35mPractical Guides for Enhancing Your Software Supply Chain Security
39mReflections on Trust in the Software Supply Chain
34mFrom development to release: Protecting the software supply chain