Skip to content

Software supply chain in depth

End-to-end, verifiable trust from commit to running workload: the supply-chain threat model and SLSA levels, in-toto attestations and build provenance, Sigstore internals (cosign, Fulcio keyless, Rekor transparency log), SBOMs with Syft/Grype and VEX, dependency integrity, and enforcing it all at admission — plus hardening the CI/CD pipeline itself. Builds on the intermediate supply-chain course.

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test

01

Threat model & SLSA

3 lessonsTest yourself

01Supply-chain threat modelThe trust handoffs from commit to deploy, and how they break.30 min 02SLSA levels & provenanceThe Build track, L1–L3, and non-falsifiable provenance.35 min 03Hermetic & reproducible buildsPinned inputs, isolation, bit-identical output.30 min

02

Provenance & in-toto

3 lessonsTest yourself

01Build provenance in practiceWhat it asserts and why the build must be hardened.30 min 02in-toto attestationsSubject, predicate, and composing evidence.35 min 03Verification summary & policyVSAs and requiring multiple claims before trust.25 min

03

Sigstore & signing

3 lessonsTest yourself

01cosign: sign & verify by identityVerify who signed, not just that it is signed.35 min 02Fulcio & keyless signingShort-lived certs bound to OIDC identity.30 min 03Rekor transparency logDurable, tamper-evident proof of signing.30 min

04

SBOM & dependency integrity

3 lessonsTest yourself

01SBOMs with SyftSPDX/CycloneDX, signed and attached by digest.30 min 02Scanning, VEX & re-scanGate on what matters; catch new CVEs later.30 min 03Dependency integrityPin, lock, verify; confusion and typosquats.30 min

05

Admission & pipeline hardening

3 lessonsTest yourself

01Verify at admissionpolicy-controller/Kyverno; identity + attestations by digest.35 min 02Registry securityPush control, immutable tags, trust the digest.25 min 03Hardening the pipelinePin actions by SHA, OIDC, ephemeral runners.35 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

60 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam