container-security
Resources for the O'Reilly Container Security book
Supply Chain Security
References
- p. 87 — OpenSSF
- p. 87 — SLSA: Getting started
- p. 88 — We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (Spracklen et al)
- p. 88 — xkcd 353: Python
- p. 89 — CycloneDX
- p. 89 — OpenSSF WG: Securing software repositories
- p. 90 - Distroless
- p. 90 - AWS Amazon Linux 2023 Minimal image
- p. 90 — Microsoft Azure Linux Distroless minimal image
- p. 90 — Canonical Chisel
- p. 90 — Slim Toolkit
- p. 91 — Docker multi-stage builds
- p. 92 — Capital One multi-stage build examples
- p. 94 — GitHub Actions and CodeBuild integration
- p. 95 — Syft
- p. 95 — Trivy
- p. 96 — Notary Project
- p. 96 — Notary Notation
- p. 96 — Sigstore
- p. 97 — SLSA GitHub generator (Go)
- p. 97 — in-toto
- p. 98 — ORAS
- p. 98 — ttl.sh ephemeral registry
- p. 102 — NIST: Executive Order 14028 on Improving the Nation’s Cybersecurity
- p. 103 — SLSA Verifier
- p. 103 — Kyverno
- p. 103 — Gatekeeper (OPA project)