Securing the Supply Chain: A Practical Guide to SLSA Compliance from Build to Runtime

Explore a comprehensive guide to securing the software supply chain through SLSA (Supply-chain Levels for Software Artifacts) compliance in this 34-minute conference talk by Enguerrand Allamel from Ledger at CNCF's KubeCon event. Gain insights into foundational practices for securing software from build to runtime using CNCF tools. Learn how to leverage GitHub Actions for automating build processes, integrate Cosign for keyless artifact signing, and implement Kyverno for runtime policy enforcement. Discover the roles of in-toto and Kubescape in managing and verifying artifact integrity within the Kubernetes ecosystem. Understand the potential integration of Hardware Security Modules (HSMs) for enhanced key management security in signing processes. Perfect for beginners, this talk provides a practical approach to navigating supply chain security complexities and achieving SLSA compliance in cloud-native environments.