Symantecs
Some checks failed
Gitea Actions Demo Training / Explore-Gitea-Actions (push) Failing after 0s

This commit is contained in:
2023-11-29 08:59:09 +01:00
parent 39e0c614f2
commit dbfb5489ad
6 changed files with 18 additions and 23 deletions

View File

@@ -2,7 +2,7 @@
By far not complete, but check this out:
## Generating SBOM's
## Generating SBOMs
<https://github.com/kubernetes-sigs/bom>
@@ -14,7 +14,7 @@ By far not complete, but check this out:
---
## Storing SBOM's
## Storing SBOMs
<https://github.com/dlorenc/sbom-oci>
@@ -22,9 +22,9 @@ By far not complete, but check this out:
<https://dependencytrack.org>
---
---
## Analysis
## Analyzing SBOMs
<https://dependencytrack.org>

View File

@@ -1,4 +1,4 @@
## Introductions
## Introduction
- Hello! I am:
@@ -6,10 +6,10 @@
- 🏢 Employed by i-share (www.i-share.nl)
- 👷🏼‍♂️ Devops/Gitops/Cloud/Container/Cluster/Linux engineer (Pick one)
- 👷🏼‍♂️ Devops/GitOps/Cloud/Container/Cluster/Linux engineer (Pick one)
- 🎯 Passion: Secure K8S clusters (air-gapped) running secure containers
--
I've only got 5 minutes so let's move on
I've only got 5 minutes so let's move on.

View File

@@ -1,5 +1,5 @@
class: pic
## Remember the word (and scan this link)
## Remember that word (and scan this link)
.center[![sbom](images/sbom/kcd-utrecht-2023-qrcode.png)]

View File

@@ -4,11 +4,6 @@ class: pic
.center[![sbom](images/sbom/container-with-junk.jpg)]
??
Do you want this in production?
A container full of junk you don't need
---
## And do you remember:
@@ -20,12 +15,12 @@ A container full of junk you don't need
---
class: pic
## Like foodlabels SBOM tell you whay's inside
## Like food labels SBOMs tell you what's inside
.center[![sbom](images/sbom/can-1.jpg)]
???
The foodlabel helps to determine the content of the package, even before you purchase the product.
The food label helps to determine the content of the package, even before you purchase the product.
---
@@ -62,6 +57,6 @@ class: pic
---
class: pic
## And analyze them
## And analyze them before you install something
.center[![sbom](images/sbom/sbom-scan-result.png)]

View File

@@ -45,7 +45,7 @@ And if they do: How often are you surprised?
--
SBOM's are similar.
SBOMs are similar.
???
The foodlabel helps to determine the content of the package
@@ -120,7 +120,7 @@ Licenses violations can cause issues as well
---
## Using SBOM's to obtain foreknowledge of CVE's
## Using SBOMs to obtain foreknowledge of CVE's
Knowing upfront which CVE's could be deployed is a check that can be done easily if the SBOM file is available.
@@ -175,13 +175,13 @@ Example taken from: https://aquasecurity.github.io/trivy/v0.33/docs/attestation/
## Deployment prevention
Inspecting SBOM's is best done before deploying containers and friends. Prevention is always best.
Inspecting SBOMs is best done before deploying containers and friends. Prevention is always best.
The OCI standard allows storing SBOM information in container registries which could be nice for future use.
The docker buildkit has builtin functionallity, eg: `docker buildx build --sbom=true -t <myorg>/<myimage> --push .` will automaticcaly create a SBOM and push it to the registry.
SBOM's can be generated by other commands as well and stored in other places.
SBOMs can be generated by other commands as well and stored in other places.
Consider analyzing the information of the SBOM in a deployment pipeline and take action if necessary.

View File

@@ -4,10 +4,10 @@ class: pic
.center[![sbom](images/sbom/tom-jones-sex-bomb.jpeg)]
Whenever I talk about SBOM's René (a collegue) can't get this tune out of his head.
Whenever I talk about SBOMs René (a colleague) can't get this song out of his head.
I hope you have the same experience and can't stop thinking about SBOM's...
I hope you have the same experience and can't stop thinking about SBOMs...
???
Sex Bomb is a song from 1999 by Tom Jones and dj Mousse
Sex Bomb is a song from 1999 by Tom Jones and dj Mousse