Skip to content

Software supply chain security

The complete secure-CI/CD picture. Start from the supply-chain threat landscape and the DevSecOps mindset, then secure each link: the source and its dependencies, the build (SLSA, hermetic and reproducible), signing and attestation (Sigstore, SBOMs, in-toto provenance), verification and policy enforcement at admission, and the operating practices — continuous rescanning, VEX, and incident response — that keep it working. Eighteen lessons across six sections, each ending with a self-test.

Advanced6 sections · 18 lessons · ~9h total · 54-question self-test

01

Threat landscape & mindset

3 lessonsTest yourself

01The software supply chain & why it is targetedEvery link from commit to cluster is attack surface.12 min 02Anatomy of real supply-chain attacksSolarWinds, dependency confusion, Codecov, xz.14 min 03DevSecOps: shift left, assume breachSecurity as everyone’s job, in the pipeline.12 min

02

Securing source & dependencies

3 lessonsTest yourself

01Securing the sourceBranch protection, signed commits, least privilege.12 min 02Dependency integrityPinning, lockfiles, and dependency confusion.14 min 03Managing updates safelyDependabot/Renovate and a patch cadence.10 min

03

Build integrity & SLSA

3 lessonsTest yourself

01The SLSA framework & levelsWhat each level buys, and what it costs.14 min 02Hermetic & reproducible buildsSame inputs, same bytes, no network.14 min 03Trusted, isolated buildersA build you can actually trust the output of.12 min

04

Sign, attest & inventory

3 lessonsTest yourself

01Sigstore: Cosign, Fulcio & RekorKeyless signing and the transparency log.14 min 02SBOMs: generate, store, querySPDX, CycloneDX, and the zero-day drill.12 min 03in-toto attestations & provenanceSigned statements about how an artifact was made.14 min

05

Verify & enforce

3 lessonsTest yourself

01Verification at admissionThe last gate: unsigned means unscheduled.14 min 02Policy-as-code gatesKyverno & OPA enforce what must be true.12 min 03Registry trust & allowed sourcesPin who you pull from, not just what.10 min

06

Operate DevSecOps

3 lessonsTest yourself

01Continuous rescanning & VEXYesterday’s clean image is today’s CVE.12 min 02Supply-chain incident responseWhen a dependency or build is compromised.12 min 03A DevSecOps maturity roadmapWhere to start, and what "good" looks like.12 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

54 questions drawn from all 6 sections — every answer explained as you pick.

Start final exam