Building Sigstore Policies from Scratch
Learn to create and implement Sigstore policies for secure software supply chains, enhancing your project's integrity and trust in the cloud-native ecosystem.
The Road to SLSA4 - Applying the Sigstore Ecosystem in a Corporate Environment
Explore Sigstore ecosystem implementation for software artifact integrity, covering self-hosting, keyless signatures, OIDC tokens, and verification methodologies in various environments.
SLSA with Cosign and Kyverno - Securing Software Delivery in Cloud Native Environments
Explore SLSA, Cosign, and Kyverno for enhancing software delivery security in cloud-native environments. Learn practical techniques to safeguard your development pipeline.
Cryptographic Signatures - A Building Block Not A Panacea
Explore cryptographic signatures in software supply chain security, their benefits, limitations, and effective implementation strategies for cloud-native applications.
Fighting the Next War - Future Threats to OSS and Software Supply Chain Security
Explore future threats to open-source software and supply chain security, discussing emerging attack vectors and strategies for OSS projects to prepare and protect against evolving risks.
Software Supply Chain Security with TAG Security
Explore software supply chain security with insights on guidance, resources, and recent developments. Learn about the whitepaper, compromise catalog, and reference architecture for secure supply chains.
SLSA FRSCA Recipe for Secure Supply Chain
Explore an end-to-end solution for software supply chain security using OpenSSF-FRSCA, integrating tools like Tekton, Sigstore, and Kyverno to meet SLSA Level 3 requirements.
Verifying Software Signatures with TUF and Sigstore
Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.
How to Secure Your Supply Chain at Scale
Learn how Yahoo secures its software supply chain using open-source tools like Grafeas, Sigstore, and Kyverno. Discover strategies for source code scanning, vulnerability management, and protecting Kubernetes deployments at scale.
SBOMs, VEX, and Kubernetes - Software Supply Chain Security in Cloud Native Environments
Explore software supply chain security with experts discussing SBOMs, VEX, and their practical applications in Kubernetes environments, from open-source projects to regulated industries.
In-Toto: Attestations and Software Supply Chain Security
Explore in-toto framework's advancements in software supply chain security, including attestation verification, type mapping, and integrations with CNCF projects and industry tools.
Secure Kubernetes Supply Chain: Lessons and Tools for Project Releases
Explore Kubernetes' enhanced security features for software supply chain, including SBOMs, provenance attestations, and digital signatures. Learn to implement these tools in your projects.
Secure Your Software Supply Chain Using Observability
Explore techniques for enhancing software supply chain security through observability, focusing on key benefits and practical implementation strategies.
Top 5 Reasons and 5 Myths Debunked to Invest in Securing the Software Supply Chain
Discover key reasons and debunked myths for investing in software supply chain security, with insights on SCIM, SBOM, and SCITT to enhance your SDLC and meet compliance requirements.
Cloud Native - Protecting Software Supply Chains Using Kyverno
Explore Kyverno's role in safeguarding software supply chains, enhancing security practices, and ensuring compliance in cloud-native environments.
Putting the Supply Chain Pieces Together: A Deep Dive into the Secure Software Factory
Explore a deep dive into supply chain security, focusing on implementing CNCF's Secure Software Factory architecture using cloud-native tools to enhance software provenance and artifact trustworthiness.
Securing the Supply Chain with Witness - A Framework for Supply Chain Security
Explore Witness, an open-source framework for supply chain security, its trust model, and implementation in CI pipelines. Learn about attestation collections, policy enforcement, and integration with cloud-native tools.
Using CNCF Best Practices to Enhance Software Supply Chain Security
Enhance software supply chain security using CNCF best practices. Learn from 3M's journey to improve code security, respond to vulnerabilities, and implement standards-based SBOM.
Securing Your Container Native Supply Chain with SLSA, GitHub and Tekton
Practical guide to securing container native supply chains using SLSA principles, in-toto attestations, and step-by-step demos for achieving SLSA Level 2 in Tekton and Github Actions.
Securing Shopify's Software Supply Chain - Mitigating Supply Chain Attacks
Explore techniques for securing software supply chains, including cloud-based defenses, trust establishment, and malicious behavior detection, drawing from Shopify's experiences.
Enforcing Supply Chain Security and Simplifying Compliance Audit for ArgoCD Deployments
Explore techniques for securing supply chains and simplifying compliance audits in ArgoCD deployments using open-source tools like Guac, Sigstore, and in-toto.