Skip to content

Software supply chain in depth

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test

01

Threat model & SLSA

3 lessonsTest yourself

01Supply-chain threat modelThe trust handoffs from commit to deploy, and how they break.30 min 02SLSA levels & provenanceThe Build track, L1–L3, and non-falsifiable provenance.35 min 03Hermetic & reproducible buildsPinned inputs, isolation, bit-identical output.30 min

02

Provenance & in-toto

3 lessonsTest yourself

01Build provenance in practiceWhat it asserts and why the build must be hardened.30 min 02in-toto attestationsSubject, predicate, and composing evidence.35 min 03Verification summary & policyVSAs and requiring multiple claims before trust.25 min

03

Sigstore & signing

3 lessonsTest yourself

01cosign: sign & verify by identityVerify who signed, not just that it is signed.35 min 02Fulcio & keyless signingShort-lived certs bound to OIDC identity.30 min 03Rekor transparency logDurable, tamper-evident proof of signing.30 min

04

SBOM & dependency integrity

3 lessonsTest yourself

01SBOMs with SyftSPDX/CycloneDX, signed and attached by digest.30 min 02Scanning, VEX & re-scanGate on what matters; catch new CVEs later.30 min 03Dependency integrityPin, lock, verify; confusion and typosquats.30 min

05

Admission & pipeline hardening

3 lessonsTest yourself

01Verify at admissionpolicy-controller/Kyverno; identity + attestations by digest.35 min 02Registry securityPush control, immutable tags, trust the digest.25 min 03Hardening the pipelinePin actions by SHA, OIDC, ephemeral runners.35 min

Final exam

Test yourself on everything

60 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam