Securing CI/CD & the Software Supply Chain

Covers the pipeline as an attack surface: SLSA levels, SBOM and VEX, keyless signing with Sigstore, and the build-time attack patterns from SolarWinds to XZ Utils. Written from the SAST/DAST gates on several critical applications and the SBOM generation in the pipelines I work on today.

1. 01

   Say which SLSA level a pipeline is at and what the next one requires.

2. 02

   Sign and attest an artifact, and refuse an unsigned one at deploy time.

3. 03

   Produce an SBOM an auditor can read and a VEX statement for the findings that do not apply.

Défile sur le côté →

1. Partie I

   The pipeline attack surface

   A taxonomy of supply-chain attacks, from SolarWinds to XZ Utils, and the trust-boundary map to draw before adding controls.

2. Partie II

   SLSA: from theory to pipeline config

   What each SLSA level requires of the build, and what changes in the pipeline configuration to get there.

3. Partie III

   Artifact signing and transparency

   Keyless signing and a transparency log, and the policy check that refuses an unsigned artifact at deploy time.

4. Partie IV

   SBOM, VEX and dependency management

   SBOM formats and when each fits, VEX for the findings that do not apply, and dependency updates that do not break production.

Ce volume est en cours d’écriture. Laissez votre e-mail et je vous enverrai un seul message quand il sera lisible.