Advanced|13 hours|32 lessons

Software Supply Chain Security

A course on proving what an artifact is and deciding whether to trust it. The supply chain threat model, dependency and source integrity, build system compromise, SLSA and provenance, signing and attestation with Sigstore, SBOMs and vulnerability intelligence, and verification at deploy time. For platform and security engineers who own the build and release path.

Text-based, no videos

7 modules, 32 lessons

Lifetime access

What you'll learn

The supply chain threat model: the five stages where trust can be subverted, and why controls at one stage cannot compensate for a gap at another

How real incidents actually worked (SolarWinds, Codecov, event-stream, xz-utils) and what each would have required to detect

Dependency risk in depth: transitive exposure, install-time execution, typosquatting and dependency confusion, and pinning by digest across packages, base images, and pipeline actions

Build system integrity: hermetic builds, ephemeral runners, and removing standing cloud credentials from pipelines with federated identity

SLSA as a way to state what your build guarantees, level by level, including why Build Level 3 requires provenance a compromised build step cannot forge

Signing and attestation with Sigstore: cosign, keyless signing bound to workload identity, in-toto predicates, and what a transparency log actually proves

SBOMs that are accurate enough to use, and turning them into a fast answer to "are we affected" during a zero-day

VEX and exploitability, so vulnerability output becomes a triage queue rather than noise the team learns to ignore

Verification and enforcement at deploy time, including what happens when the verification path itself is unavailable

A capstone design of a trusted build and deploy pipeline, with every control justified and its failure mode named

Curriculum

7 modules · 32 lessons

The Supply Chain Threat Model

What a supply chain attack actually is, the five stages where trust can be subverted, what real incidents did, and what the word "verified" is supposed to mean.

4 lessons

What a Supply Chain Attack Actually Is25 minFREE The Five Stages: Source, Dependencies, Build, Artifact, Deploy25 minFREE Anatomy of Real Incidents25 minFREE Trust, Provenance, and What "Verified" Means25 minFREE

Dependencies and Source Integrity

The code you did not write and the repository it enters through: transitive dependencies, registry attacks, pinning, mirrors, and protecting the source itself.

5 lessons

The Dependency Attack Surface25 min Typosquatting and Dependency Confusion25 min Pinning, Lockfiles, and Reproducible Resolution25 min Mirrors, Vendoring, and Private Registries25 min Source Integrity: Commits, Reviews, and Repo Compromise25 min

Build Integrity

The build system as the highest-value target: isolation, hermeticity, ephemeral runners, removing standing credentials, and what a build should be able to attest to.

5 lessons

The Build System as a Target25 min Hermetic and Isolated Builds25 min Ephemeral Runners and Build Isolation25 min Pipeline Secrets and Federated Identity25 min What the Build Should Attest To25 min

SLSA and Build Provenance

The SLSA framework as a means of stating what your build guarantees: the levels, what each actually buys, and how to assess yourself honestly.

4 lessons

The SLSA Framework25 min Build Levels 1 and 225 min Build Level 3: Non-Falsifiable Provenance25 min Assessing Your Level Honestly25 min

Signing and Attestation

Making claims about an artifact that a verifier can check: signing fundamentals, Sigstore, keyless identity, in-toto attestations, and transparency logs.

5 lessons

Signing Fundamentals for Artifacts25 min Sigstore and cosign25 min Keyless Signing and Ephemeral Identity25 min In-toto Attestations and Predicates25 min Transparency Logs and What They Prove25 min

SBOM and Vulnerability Intelligence

Knowing what is actually in your artifacts, and turning that inventory into answers rather than noise.

4 lessons

SBOM Formats: SPDX and CycloneDX25 min Generating SBOMs That Are Accurate25 min Consuming SBOMs: Answering "Am I Affected?"25 min VEX and the Vulnerability Noise Problem25 min

Verification and Enforcement

Turning claims into decisions: what to verify and where, enforcing policy at deploy time, controlling registries, and responding when a dependency is compromised.

5 lessons

The Verification Decision25 min Admission-Time Policy for Signatures and Attestations25 min Registry and Artifact Repository Controls25 min Responding to a Compromised Dependency25 min Capstone: Designing a Trusted Build and Deploy Pipeline25 min

About the Author

Sharon Sahadevan

AI Infrastructure Engineer

Building production GPU clusters on Kubernetes. H100s, large-scale model serving, and end-to-end ML infrastructure across Azure and AWS.

10+ years designing cloud-native platforms with deep expertise in Kubernetes orchestration, GitOps (Argo CD), Terraform, and MLOps pipelines for LLM deployment.

Author of KubeNatives, a weekly newsletter read by 3,000+ DevOps and ML engineers for production insights on K8s internals, GPU scheduling, and model-serving patterns.

Ready to master this topic?

Start with the free preview lesson and see for yourself.