Cloud Native Supply Chain Security with Tekton and Sigstore
Hands-on overview of creating a secure zero-trust supply chain on Kubernetes using Tekton, Tekton Chains, and sigstore. Learn to protect pipelines, generate provenance, and integrate with In-Toto and SPIRE.
State of the Art Supply Chain Security - In-toto, TUF, and SigStore
Explore cutting-edge supply chain security with in-toto, TUF, and SigStore. Learn how these tools create a transparent, hack-proof system to protect software from developer to end-user.
PEP 740 and PyPI - Bootstrapping Provenance for the Python Ecosystem
Explore how PEP 740 enhances PyPI's security through digital attestations, integrating with Sigstore and SLSA to provide robust package provenance without complex key management.
A Step Closer to Secure Development: Using in-Toto and OPA Gatekeeper to Verify Artifact Integrity
Explore securing software supply chains using in-toto, Witness, Archivista, and OPA Gatekeeper. Learn to verify artifact integrity from development to Kubernetes deployment.
Secure Release Processes with in-Toto Policy Verification
Discover how to enforce secure software release processes using in-toto's policy verification system, covering attestations, SDLC compliance, and build provenance for enhanced security measures.
Practical Supply Chain Security: Implementing SLSA Compliance from Build to Runtime
Discover practical strategies for implementing SLSA compliance, from using GitHub Actions and Cosign for artifact signing to enforcing runtime policies with Kyverno and securing keys with HSMs.