How to Secure Your Supply Chain at Scale
Learn how Yahoo secures its software supply chain using open-source tools like Grafeas, Sigstore, and Kyverno. Discover strategies for source code scanning, vulnerability management, and protecting Kubernetes deployments at scale.
Keyless Code Signing Without Fulcio
Explore keyless code signing without Fulcio, understanding its benefits and implementing it with existing PKI solutions like Vault and stepca for hassle-free, secure software signing.
Growing SPIFFE and SPIRE in 2023 and Beyond - Secure Identity Management Progress
Explore SPIFFE/SPIRE's latest advancements in secure identity management, including Windows support, SIGSTORE integration, and enhanced hardware security, empowering enterprises with robust infrastructure protection.
In-Toto: Attestations and Software Supply Chain Security
Explore in-toto framework's advancements in software supply chain security, including attestation verification, type mapping, and integrations with CNCF projects and industry tools.
The Update Framework (TUF) Maintainer Panel: Integrations, Enhancements, and Supply Chain Security
Panel discussion on The Update Framework: insights on integrations, supply chain security, and open-source project maintenance from TUF maintainers across various implementations and organizations.
Putting the Supply Chain Pieces Together: A Deep Dive into the Secure Software Factory
Explore a deep dive into supply chain security, focusing on implementing CNCF's Secure Software Factory architecture using cloud-native tools to enhance software provenance and artifact trustworthiness.
Securing Your Container Native Supply Chain with SLSA, GitHub and Tekton
Practical guide to securing container native supply chains using SLSA principles, in-toto attestations, and step-by-step demos for achieving SLSA Level 2 in Tekton and Github Actions.
Enforcing Supply Chain Security and Simplifying Compliance Audit for ArgoCD Deployments
Explore techniques for securing supply chains and simplifying compliance audits in ArgoCD deployments using open-source tools like Guac, Sigstore, and in-toto.
Identity-based Source Integrity with Gitsign
Explore Gitsign, a Sigstore project for keyless, identity-based Git commit signing. Learn its benefits over traditional methods and how it enhances security in CI/CD and GitOps workflows.
Growing the Chain: Trusting Build Provenance from Userspace
Explore techniques for establishing trust in CI/CD workflows, focusing on artifact signing, provenance generation, and building a chain of trust using open-source technologies like Sigstore and OIDC.
Hands-on Introduction to Sigstore - Securing the Software Supply Chain
Comprehensive introduction to sigstore, covering container image signing, keyless mode, transparency logs, and image policy enforcement with Kyverno for enhanced software supply chain security.
Supply Chain Security - The First Steps
Explore supply chain security essentials, including zero trust, SBOMs, and sigstore. Learn to generate and utilize SBOMs to enhance software development security and meet compliance requirements.
An Introduction to Sigstore for Pythonistas
Explore Sigstore for securing Python projects: learn to sign, verify, and protect software artifacts, addressing supply chain vulnerabilities with accessible tracing methods.
The Road to Zero CVEs: People and Technology
Explore open source software vulnerabilities, supply chain security legislation, and emerging tools like Sigstore to fortify digital ecosystems and manage CVEs effectively.
Navigating the Software Supply Chain Defense Landscape
Explore software supply chain security tools and frameworks, their integration, and how to select the right combination for comprehensive protection against rising cyber threats.
Leveraging Sigstore Capabilities in a Local Environment
Explore Lockheed Martin's integration of Sigstore for secure, auditable software development. Learn about internal Kubernetes deployments, certificate authorities, and streamlined GitLab pipelines for enhanced security.
Sigstore: 2024 and Beyond
Explore Sigstore's achievements, future roadmap, and vision for securing open source software. Learn about upcoming milestones and opportunities to contribute to this de-facto signing solution.
Sigstore: Using Transparent Digital Signatures to Help Secure the Software Supply Chain
Explore transparent digital signatures with Sigstore to enhance software supply chain security. Learn key techniques for protecting open source ecosystems.
Supply Chain Security in the Enterprise
Explore open source solutions for enterprise software supply chain security, focusing on Sigstore and Archivista to enhance accountability and transparency in software development.
Managing Supply Chain Risk in a World of AI-Assisted Developers
Explore strategies for mitigating security risks associated with AI coding assistants, focusing on safe code integration and leveraging open-source tools to enhance software supply chain security.
Navigating the Intersection: AI's Role in Shaping the Secure Open Source Software Ecosystem
Explore AI's impact on open-source software security, covering OSS in AI systems, open-sourcing AI components, AI-driven security automation, and AI's evolving role in OSS development and usage.