Securing the Supply Chain: A Practical Guide to SLSA Compliance from Build to Runtime
Dive into SLSA compliance for supply chain security using CNCF tools. Explore GitHub Actions, Cosign, Kyverno, in-toto, and Kubescape to secure software from build to runtime in Kubernetes ecosystems.
Secure Supply Chain in Kubernetes
Implementação de pipelines seguros e aplicações confiáveis para Kubernetes usando ferramentas open-source como OPA e Cosign para verificações e assinaturas em uma cadeia de suprimentos de software segura.
Software Supply Chain Integrity with Sigstore
Learn about Sigstore, a tool for securing software supply chains, with demos on Cosign for signing and verifying artifacts, and insights on its practical applications.
Attesting Practically: Exploring the Glue Behind Secure Runtime Environments
Explore practical applications of attestations in software supply chain security, focusing on Cosign, in-toto, and VEX to create secure, auditable runtime environments and effectively manage security threats.
SLSA with Cosign and Kyverno - Securing Software Delivery in Cloud Native Environments
Explore SLSA, Cosign, and Kyverno for enhancing software delivery security in cloud-native environments. Learn practical techniques to safeguard your development pipeline.
Making Sense of Security Supply Chain - An Overview for Beginners
Explore supply chain security fundamentals, tools like Fulcio, Rekor, and cosign, and their integration in this beginner-friendly overview of the rapidly evolving landscape.
Growing the Chain: Trusting Build Provenance from Userspace
Explore techniques for establishing trust in CI/CD workflows, focusing on artifact signing, provenance generation, and building a chain of trust using open-source technologies like Sigstore and OIDC.
Hands-on Introduction to Sigstore - Securing the Software Supply Chain
Comprehensive introduction to sigstore, covering container image signing, keyless mode, transparency logs, and image policy enforcement with Kyverno for enhanced software supply chain security.
Securing the Supply Chain: A Practical Guide to SLSA Compliance from Build to Runtime
Practical guide to securing software supply chain using CNCF tools. Covers SLSA compliance, GitHub Actions, Cosign, Kyverno, in-toto, and Kubescape for build-to-runtime security in Kubernetes ecosystems.
Leveraging Sigstore Capabilities in a Local Environment
Explore Lockheed Martin's integration of Sigstore for secure, auditable software development. Learn about internal Kubernetes deployments, certificate authorities, and streamlined GitLab pipelines for enhanced security.
SLSA: A Security Paradigm for Software Supply Chain Integrity
Explore SLSA levels, software supply chain security basics, and tools like Cosign to enhance artifact integrity and benefit your organization.
Power of AI: DevSecOps and Cloud Artifact Signing Explored - Sessions 1 and 2
Explore AI's impact on DevSecOps and cloud artifact signing. Learn how AI enhances security automation, vulnerability scanning, and threat detection. Discover tools for ensuring trust and integrity in cloud environments.
Harbor - Enterprise Cloud Native Artifact Registry
Explore advanced features of Harbor, an open-source registry for cloud-native artifacts. Learn about image signatures, cloud management, unified Helm and container handling, and high-availability deployments.
Trust in Honk, Tie Up Your YAML - A Kpack Experience for Container Image Building
Explore kpack for building container images on Kubernetes, leveraging Cloud Native Buildpacks and enhancing supply chain security through declarative resources and automated processes.
Securing Kubernetes Manifests with Sigstore and Kyverno
Learn to secure Kubernetes resources using Sigstore for signing YAML definitions and Kyverno for verification during admission controls, with real-world use cases for tamper-prevention and approval workflows.
Demystify Modern Signing: Keys, Certificates, and Envelopes
Explore practical aspects of cryptographic signing tools, covering key algorithms, signing envelopes, certificates, and verification, with a focus on identity-based signing using short-lived keys.
Modernizing Image Security in CI/CD with Cosign and OPA
Explore Cosign for image signing and OPA for policy enforcement in CI/CD pipelines. Learn implementation strategies and see a hands-on demo for securing Kubernetes deployments.
Verifying and Signing EBPF Programs with Inspektor Gadget
Enhance eBPF program security with Inspektor Gadget. Learn to sign and verify OCI images using cosign, improving overall system safety by running only authenticated eBPF programs.
From Cosign to an Ecosystem - The Evolution of Sigstore
Explore the evolution of Sigstore's software security ecosystem, from its core components to advanced integrations for package managers, CI workflows, and policy enforcement tools.
Exploring Essential Security Checks for Open Source Go Projects
Discover essential security tools for Go projects: gosec, govulncheck, and sigstore/cosign. Learn to enhance code security, scan vulnerabilities, and secure the supply chain.
Secure Kubernetes Manifests with Cosign and Kyverno
Explore open-source tools Cosign and Kyverno to secure container images and Kubernetes manifests. Learn implementation strategies for production clusters and essential use cases.