Eating the Open Source Security Sandwich with Skootrs
Explore Skootrs, an open-source tool simplifying adoption of security practices for software developers through automation and guardrails.
A Beginner's View of Public Instances
Explore OpenSSF's public instances: hosting, scale, security, and usage guidelines. Gain insights into tools for safer software development and protection against attackers.
Getting Involved in Sigstore Research Projects
Explore Sigstore's research opportunities in privacy-conscious transparency, stronger verification assurances, and distributed trust timestamping. Learn how to contribute to this open-source project.
Navigating the Intersection: AI's Role in Shaping the Secure Open Source Software Ecosystem
Explore AI's impact on open-source software security, covering OSS in AI systems, open-sourcing AI components, AI-driven security automation, and AI's evolving role in OSS development.
Sigstore: Past, Present and Future Directions
Explore Sigstore's journey, impact on OSS code signing, and future plans. Learn about its adoption by major projects and integration efforts with package managers.
Sigstore: Using Transparent Digital Signatures to Help Secure the Software Supply Chain
Explore transparent digital signatures with Sigstore to enhance software supply chain security and learn practical implementation strategies.
Implementing DevSecOps in Production with Stackrox and Tekton
Implement robust DevSecOps pipelines using Stackrox and Tekton. Eliminate security risks, secure the software supply chain, and provide automated guardrails for developers.
Enforcing Organization Policies with Enterprise Contract
Learn to enforce organizational policies on container images using Enterprise Contract, leveraging Sigstore signatures and in-toto attestations within the Tekton ecosystem.
Secure Software Supply Chain: Current State in PHP and Drupal Ecosystem
Explore the secure software supply chain, recent global events, and tools for digital signatures, SBOM generation, and vulnerability scanning in PHP and Drupal projects.
Protect the Pipe - A Policy-based Approach for Securing CI/CD Pipelines
Explore a cloud-native security framework for CI/CD pipelines using in-toto, Kyverno, and sigstore. Learn to implement policy-based controls and address unique security challenges in modern application delivery.
Verifiable Build Environments in the Cloud - Powered by Sigstore and Enclaves
Explore how Sigstore enhances confidential computing security, minimizing trusted compute base while maintaining engineering velocity. Learn about cloud-based verifiable build environments.
Securing the npm Ecosystem - Enhancing Trust in Open Source
Learn about GitHub's efforts to secure the npm ecosystem, including 2FA, Sigstore, and other measures to protect open source dependencies and prevent account takeovers.
Secure Python Packaging and Release Using Continuous Deployment
Learn to securely package and release Python projects using continuous deployment, covering security improvements, build reproducibility, automated PyPI deployment, and release signing with Sigstore.
Open Source Security and Supply Chain Innovations - Keynote Sessions
Explore cutting-edge topics in open source security, including supply chain protection, Sigstore, SPDX, eBPF, SLSA, and memory safety, presented by industry leaders and experts.
Securing GitOps Supply Chain with Sigstore and Kyverno
Learn to secure GitOps supply chain by signing and verifying container images using Sigstore and Kyverno, eliminating security risks and ensuring only trusted images are deployed in Kubernetes clusters.
Securing Kubernetes Manifests with Sigstore and Kyverno
Learn to secure Kubernetes resources using Sigstore for signing YAML definitions and Kyverno for verification during admission controls, with real-world use cases for tamper-prevention and approval workflows.
Building Images for the Secure Supply Chain
Techniques and tools for building secure container images, including distroless philosophy, updating dependencies, using apko for reproducibility, and signing with Sigstore.
Trust But Verify: Bringing Supply Chain Integrity to CD GitOps
Explore how to enhance CD GitOps with supply chain controls, ensuring integrity and tamper-proof deployments through keyless signing, transparency logs, and cluster enforcement of signatures and policies.
CRI-O's Senior Year - Overview and New Developments
Explore CRI-O's journey towards CNCF graduation, including new developments like conmon-rs, sigstore integration, and Kubernetes alignment for enhanced container runtime stability and security.
Who's Verifying Your Signatures? Approaching Private Container Image Signing
Explore container image signing for private use, comparing open-source and internal challenges. Learn about leading frameworks and their scalability for secure software delivery.
Sigstore - How We Learned to Stop Trusting Registries and Love Signatures
Explore InfluxData's journey in implementing container image signing for their SaaS offering, covering the process, challenges, and technical details from DevOps and security perspectives.