Security (DevSecOps) · Module 05

Software supply chain security

Most of your software is other people’s code: scan and update dependencies, keep base images small and fresh, sign images with cosign, and understand supply-chain attacks and the SLSA framework.

Practice interactively →

What you will learn

• Scan dependencies with ecosystem tools and update them automatically with Dependabot or Renovate
• Choose small base images, pin by digest, use multi-stage builds and a non-root user
• Sign and verify container images with cosign, including keyless signing
• Recognise typosquatting, dependency confusion and compromised builds, and describe the SLSA levels

Lessons

1. Scanning and updating dependencies

   Every library drags in dozens of indirect ones; use lockfiles, scan with npm audit, pip-audit, Trivy or OSV-Scanner, and let Dependabot or Renovate open update pull requests regularly.

2. Base image hygiene

   The base image drives most of your CVE count and attack surface; choose small official images, pin by digest, use multi-stage builds, run as a non-root user and rebuild regularly.

3. Signing and verifying images with cosign

   A signature proves who built an image and that it has not been altered; Sigstore’s cosign signs with a key or keylessly through OIDC, stores signatures next to the image in the registry, and clusters can reject unsigned images.

4. Supply-chain attacks and the SLSA framework

   Attackers target where you get code and where you build it rather than your app; recognise typosquatting, dependency confusion, compromised maintainers and build systems, and use SLSA to raise trust in artifacts.