Trusting what you build on.
WHAT THE SUPPLY CHAIN IS
Everything entering your image: base images, packages, dependencies, build tools.
WHAT THE RISKS ARE
A compromised base image A dependency with malicious code A package repository that was tampered with A build system that was compromised
WHAT TO DO ABOUT BASE IMAGES
Use official ones Pin to a digest, not a tag Rebuild on a schedule
WHY PIN TO A DIGEST
A tag can be moved; a digest cannot.
WHAT TO DO ABOUT DEPENDENCIES
Pin versions with a lock file Review what is added Scan for known vulnerabilities
WHAT A SOFTWARE BILL OF MATERIALS IS
A record of everything in the image.
WHAT IT ENABLES
Answering whether you are affected when a vulnerability is announced.
WHY THAT MATTERS
That question arrives urgently, and reconstructing the answer takes days.
WHAT TO GENERATE
One per build, stored with the image.
WHAT SIGNING PROVIDES
Proof an image came from your pipeline.
WHAT VERIFICATION ADDS
Refusing to run anything unsigned.
WHERE THAT IS ENFORCED
An admission policy in the cluster.
WHAT TO PROTECT MOST
The build system itself.
WHY
It can produce anything, signed.
