Skip to content

Commit 9ee0259

Browse files
nicholasdillenicholasdille
committed
Final slides for 20230711
1 parent 2c86d2b commit 9ee0259

19 files changed

+2090
-32
lines changed

‎060_security/11_artifacts/slides.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Open Container Initiative (OCI) is responsible for multiple specifications:
77
- Distribution <span style="color: grey;">(how to talk to image registries)</span> [](https://github.com/opencontainers/distribution-spec)
88
- Artifact <span style="color: grey;">(how to store arbitraty data in registries)</span> [](https://github.com/opencontainers/artifacts)
99

10-
OCI is slowly replacing Docker media types
10+
OCI is replacing Docker media types
1111

1212
Version 1.1 is in the making
1313

‎120_kubernetes/kyverno/prepare.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/bin/bash
22
set -o errexit
33

4-
docker-setup --tools=docker,buildx,docker-compose,kind,helm,kubectl,cosign,kyverno install
4+
docker-setup install docker buildx docker-compose kind helm kubectl cosign kyverno
55

66
kind create cluster
77

‎170_supply_chain_security/cosign/cosign.demo

+9-9
Original file line numberDiff line numberDiff line change
@@ -26,17 +26,17 @@ regctl manifest get ghcr.io/nicholasdille/container-slides/ubuntu:sha256-${DIGES
2626
https://search.sigstore.dev/
2727

2828
# Verify signature
29-
EMAIL=???
30-
COSIGN_EXPERIMENTAL=1 cosign verify ghcr.io/nicholasdille/container-slides/ubuntu:22.04 --certificate-oidc-issuer https://github.com/login/oauth --cer
31-
tificate-identity ${EMAIL}
29+
COSIGN_EXPERIMENTAL=1 cosign verify ghcr.io/nicholasdille/container-slides/ubuntu:22.04 \
30+
--certificate-oidc-issuer https://github.com/login/oauth \
31+
--certificate-identity-regexp 'nicholas.dille@.+'
3232

3333
# Sign arbitrary artifact
34-
curl -sLO https://github.com/aquasecurity/trivy/releases/download/v0.41.0/trivy_0.41.0_Linux-64bit.tar.gz
35-
curl -sLO https://github.com/aquasecurity/trivy/releases/download/v0.41.0/trivy_0.41.0_Linux-64bit.tar.gz.pem
36-
curl -sLO https://github.com/aquasecurity/trivy/releases/download/v0.41.0/trivy_0.41.0_Linux-64bit.tar.gz.sig
37-
COSIGN_EXPERIMENTAL=1 cosign verify-blob trivy_0.41.0_Linux-64bit.tar.gz \
38-
--certificate trivy_0.41.0_Linux-64bit.tar.gz.pem \
39-
--signature trivy_0.41.0_Linux-64bit.tar.gz.sig \
34+
curl -sLO https://github.com/aquasecurity/trivy/releases/download/v0.43.1/trivy_0.43.1_Linux-64bit.tar.gz
35+
curl -sLO https://github.com/aquasecurity/trivy/releases/download/v0.43.1/trivy_0.43.1_Linux-64bit.tar.gz.pem
36+
curl -sLO https://github.com/aquasecurity/trivy/releases/download/v0.43.1/trivy_0.43.1_Linux-64bit.tar.gz.sig
37+
COSIGN_EXPERIMENTAL=1 cosign verify-blob trivy_0.43.1_Linux-64bit.tar.gz \
38+
--certificate trivy_0.43.1_Linux-64bit.tar.gz.pem \
39+
--signature trivy_0.43.1_Linux-64bit.tar.gz.sig \
4040
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
4141
--certificate-identity-regexp 'https://github.com/aquasecurity/trivy/.github/workflows/reusable-release.yaml@refs/tags/v*' \
4242
--certificate-github-workflow-repository aquasecurity/trivy

‎170_supply_chain_security/cosign/demo.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Demo [<i class="fa fa-comment-code"></i>](https://github.com/nicholasdille/container-slides/blob/master/170_supply_chain_security/cosign/cosign.demo "cosign.demo")
2+
3+
Sign a container image
4+
5+
Keyless sign of a container image
6+
7+
Verify the signature of a container image

‎170_supply_chain_security/cosign/slides.md

-10
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,3 @@ Kyverno has support builtin
3737
Bootstrapping the tooling is important
3838

3939
Check the supply chain of required tools
40-
41-
---
42-
43-
## Demo [<i class="fa fa-comment-code"></i>](https://github.com/nicholasdille/container-slides/blob/master/170_supply_chain_security/cosign/cosign.demo "cosign.demo")
44-
45-
Sign a container image
46-
47-
Keyless sign of a container image
48-
49-
Verify the signature of a container image

‎170_supply_chain_security/sbom-operator/dashbaord-cve-by-image.json

+257
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,257 @@
1+
{
2+
"annotations": {
3+
"list": [
4+
{
5+
"builtIn": 1,
6+
"datasource": {
7+
"type": "grafana",
8+
"uid": "-- Grafana --"
9+
},
10+
"enable": true,
11+
"hide": true,
12+
"iconColor": "rgba(0, 211, 255, 1)",
13+
"name": "Annotations & Alerts",
14+
"type": "dashboard"
15+
}
16+
]
17+
},
18+
"editable": true,
19+
"fiscalYearStartMonth": 0,
20+
"graphTooltip": 0,
21+
"id": 3,
22+
"links": [],
23+
"liveNow": false,
24+
"panels": [
25+
{
26+
"datasource": {
27+
"type": "prometheus",
28+
"uid": "PBFA97CFB590B2093"
29+
},
30+
"fieldConfig": {
31+
"defaults": {
32+
"color": {
33+
"mode": "palette-classic"
34+
},
35+
"custom": {
36+
"axisCenteredZero": false,
37+
"axisColorMode": "text",
38+
"axisLabel": "",
39+
"axisPlacement": "auto",
40+
"barAlignment": 0,
41+
"drawStyle": "line",
42+
"fillOpacity": 0,
43+
"gradientMode": "none",
44+
"hideFrom": {
45+
"legend": false,
46+
"tooltip": false,
47+
"viz": false
48+
},
49+
"lineInterpolation": "linear",
50+
"lineWidth": 1,
51+
"pointSize": 5,
52+
"scaleDistribution": {
53+
"type": "linear"
54+
},
55+
"showPoints": "auto",
56+
"spanNulls": false,
57+
"stacking": {
58+
"group": "A",
59+
"mode": "none"
60+
},
61+
"thresholdsStyle": {
62+
"mode": "off"
63+
}
64+
},
65+
"mappings": [],
66+
"thresholds": {
67+
"mode": "absolute",
68+
"steps": [
69+
{
70+
"color": "green",
71+
"value": null
72+
},
73+
{
74+
"color": "red",
75+
"value": 80
76+
}
77+
]
78+
}
79+
},
80+
"overrides": []
81+
},
82+
"gridPos": {
83+
"h": 9,
84+
"w": 24,
85+
"x": 0,
86+
"y": 0
87+
},
88+
"id": 1,
89+
"options": {
90+
"legend": {
91+
"calcs": [],
92+
"displayMode": "list",
93+
"placement": "bottom",
94+
"showLegend": true
95+
},
96+
"tooltip": {
97+
"mode": "single",
98+
"sort": "none"
99+
}
100+
},
101+
"targets": [
102+
{
103+
"datasource": {
104+
"type": "prometheus",
105+
"uid": "PBFA97CFB590B2093"
106+
},
107+
"editorMode": "code",
108+
"expr": "count by (severity) (vuln_operator_cves{image_id=\"$image\"})",
109+
"instant": false,
110+
"legendFormat": "__auto",
111+
"range": true,
112+
"refId": "A"
113+
}
114+
],
115+
"title": "CVEs by severity",
116+
"type": "timeseries"
117+
},
118+
{
119+
"datasource": {
120+
"type": "prometheus",
121+
"uid": "PBFA97CFB590B2093"
122+
},
123+
"fieldConfig": {
124+
"defaults": {
125+
"color": {
126+
"mode": "palette-classic"
127+
},
128+
"custom": {
129+
"axisCenteredZero": false,
130+
"axisColorMode": "text",
131+
"axisLabel": "",
132+
"axisPlacement": "auto",
133+
"barAlignment": 0,
134+
"drawStyle": "line",
135+
"fillOpacity": 0,
136+
"gradientMode": "none",
137+
"hideFrom": {
138+
"legend": false,
139+
"tooltip": false,
140+
"viz": false
141+
},
142+
"lineInterpolation": "linear",
143+
"lineWidth": 1,
144+
"pointSize": 5,
145+
"scaleDistribution": {
146+
"type": "linear"
147+
},
148+
"showPoints": "auto",
149+
"spanNulls": false,
150+
"stacking": {
151+
"group": "A",
152+
"mode": "none"
153+
},
154+
"thresholdsStyle": {
155+
"mode": "off"
156+
}
157+
},
158+
"mappings": [],
159+
"thresholds": {
160+
"mode": "absolute",
161+
"steps": [
162+
{
163+
"color": "green",
164+
"value": null
165+
},
166+
{
167+
"color": "red",
168+
"value": 80
169+
}
170+
]
171+
}
172+
},
173+
"overrides": []
174+
},
175+
"gridPos": {
176+
"h": 9,
177+
"w": 24,
178+
"x": 0,
179+
"y": 9
180+
},
181+
"id": 2,
182+
"options": {
183+
"legend": {
184+
"calcs": [],
185+
"displayMode": "list",
186+
"placement": "bottom",
187+
"showLegend": true
188+
},
189+
"tooltip": {
190+
"mode": "single",
191+
"sort": "none"
192+
}
193+
},
194+
"targets": [
195+
{
196+
"datasource": {
197+
"type": "prometheus",
198+
"uid": "PBFA97CFB590B2093"
199+
},
200+
"editorMode": "code",
201+
"expr": "count by (package, version) (vuln_operator_cves{image_id=\"$image\"})",
202+
"instant": false,
203+
"legendFormat": "{{package}}@{{version}}",
204+
"range": true,
205+
"refId": "A"
206+
}
207+
],
208+
"title": "CVEs by package",
209+
"type": "timeseries"
210+
}
211+
],
212+
"refresh": "10s",
213+
"schemaVersion": 38,
214+
"style": "dark",
215+
"tags": [],
216+
"templating": {
217+
"list": [
218+
{
219+
"current": {
220+
"selected": false,
221+
"text": "docker.io/grafana/grafana@sha256:c2a9d25b77b9a7439e56efffa916e43eda09db4f7b78526082443f9c2ee18dc0",
222+
"value": "docker.io/grafana/grafana@sha256:c2a9d25b77b9a7439e56efffa916e43eda09db4f7b78526082443f9c2ee18dc0"
223+
},
224+
"datasource": {
225+
"type": "prometheus",
226+
"uid": "PBFA97CFB590B2093"
227+
},
228+
"definition": "label_values(image_id)",
229+
"hide": 0,
230+
"includeAll": false,
231+
"label": "Image",
232+
"multi": false,
233+
"name": "image",
234+
"options": [],
235+
"query": {
236+
"query": "label_values(image_id)",
237+
"refId": "PrometheusVariableQueryEditor-VariableQuery"
238+
},
239+
"refresh": 1,
240+
"regex": "",
241+
"skipUrlSync": false,
242+
"sort": 0,
243+
"type": "query"
244+
}
245+
]
246+
},
247+
"time": {
248+
"from": "now-6h",
249+
"to": "now"
250+
},
251+
"timepicker": {},
252+
"timezone": "",
253+
"title": "CVEs by Image",
254+
"uid": "d4e451d2-0482-4477-9376-8e6ad31ec6fc",
255+
"version": 2,
256+
"weekStart": ""
257+
}

0 commit comments

Comments
 (0)