What does it take to deploy to production with confidence?
summary
Explains how to ship with measurable confidence by adopting reproducible builds (Maven/Gradle plugins + fixed timestamps) and producing SBOMs now required by EU law with enforcement in Jan 2027; recommends provenance and Salsa levels to audit CI/CD, shows JReleaser automating releases to package managers and Maven Central, and Sigstore for ephemeral key signing recorded on a public ledger so keys can be discarded. Cites 80% OSS in codebases and that 40% of Log4j downloads remain vulnerable to underline urgency.
AI-written summary · about
chapters (16)
- 0:00Deploying with confidence
- 2:09Unicorns and deployment confidence
- 7:50CDF CI/CD pipeline standards
- 13:21Repeatable vs reproducible builds
- 15:25Verifying Maven Central builds
- 18:43Reproducible builds with Maven/Gradle
- 21:56Supply chain security risks
- 23:23Introducing SLSA
- 28:21Need for SBOMs in compliance
- 30:27SBOM standards and tools
- 33:18Log4Shell lessons
- 35:25Maven Central deployment challenges
- 36:51Automating releases with JReleaser
- 38:59Simplifying digital signatures
- 41:07Improving transparency with changelogs
- 42:37Summary
related talks
22mWhat does it take to deploy to production with confidence?
45mDeploying to production with confidence
49mDeploying to production with confidence
48mCRA, NIS2, DORA: What Senior Java Engineers Must Deliver Before 2027
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
23mMastering Secure Software Supply Chains
30mSupply Chain Security for OpenSource Projects
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond