Making Quillon Payroll Services' path from source to production provable: the delivery rail runs through eight stations — source, dependencies, build, provenance, signing, registry, admission and runtime — each with its measured count, from 57 of 188 production digests untraceable at the start to 191 of 194 running digests verifiably built and admitted. Alongside, the customer audit question nobody could answer: the payslip-render image built on a laptop during a hotfix and pushed with a token shared by 14 pipelines, now closed with a signed Standard and Register.

CY-EXPERT-084Expert Level · Supply Chain Security

Secure Delivery Programme Optimisation

An expert-level course on making the path from source code to production trustworthy and provable. Follow software along the delivery rail - eight stations from reviewed source, through pinned and mirrored dependencies, single-use builders, platform-generated provenance, a governed release signature and an immutable registry, to an admission gate that runs only what verifies and a runtime inventory that proves what runs - and assemble a standard and register that an architecture board can adopt, a customer can verify and an auditor can re-perform.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Trace production workloads from runtime digests to reviewed source, inventory production from runtime, map the delivery path's trust points and set testable objectives.
Fix build inputs with enforced lockfiles and a single enforced mirror, and prevent dependency-confusion and typosquatting risks through scoping and intake review.
Replace shared build machines and secrets with single-use runners and short-lived project-bound credentials, and generate accurate build-time SBOMs.
Verify platform-generated provenance against a written policy and record precisely what provenance does not prove.

Price:৳12,000