A presentation at Code Europe by Aurélie Vache
Have you managed to package/build your application as a container image, with Docker or Podman, and push it into an image/artifact registry? Congratulations… but the work is not finished đŸ™‚. Now it’s time to implement the best practices of Software Supply Chain Security!
Why and how to sign an image? Why and how to generate the inventory of my image? Does my image have vulnerabilities? Are they exploitable? What is the purpose of attestations? How to automate all this?
In this talk, step by step, with a mix of slides and live demos, we will see all that, and much more.
You will know how to implement these best practices, locally and even in your CI/CD pipelines.
And bonus track, after this talk terms like ‘cosign’, ‘sbom’, ‘vex’, ‘in-toto’… will no longer have any secrets for you!
