Supply-chain security
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
understand attacks on how software is built and delivered, and the controls.
Planned topics
- Risks: typosquatting (a look-alike package name), dependency confusion, compromised maintainers, compromised build systems.
- Controls: lock and verify dependencies, use an internal artifact proxy, least-privilege pipelines, protected branches.
- Sign artifacts and images (for example Sigstore cosign) and keep provenance (who built what, from which commit); SLSA is a framework for levels of assurance. Verify tool details before recording.
- Verify signatures at deploy time with an admission policy.
Draft outline details
Demonstration
pipeline diagram: source → build (provenance) → sign → registry → cluster admission check.
Check your understanding
What does a signature on an image prove?
Show answer
That a trusted identity produced it and it was not changed since.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.