The Chain of Command - Building Trust Across Public Sector Software Pipelines

Explore the unique challenges and emerging solutions for software supply chain security in public sector organizations through this 43-minute conference talk from the Linux Foundation. Learn about the critical gaps in current practices, including the absence of standardized software entry protocols for isolated networks, lack of shared trust frameworks, and missing guidance for integrating public and private attestations. Discover how public sector consumers can establish trusted attestations that verify software origin, integrity, and authorship across companies, networks, and government entities. Examine the balance between maintaining stringent security requirements while ensuring small suppliers aren't excluded from the ecosystem. Gain insights from the CNCF's Cloud Native Public Sector User Group's recent publications on advancing cloud-native best practices within government and public organizations, with practical takeaways on current supply chain security challenges, trust and attestation requirements, and scalable solutions that work across suppliers of all sizes.