Securing Northwind's path from source code to what customers run: an eight-stage pipeline — source, dependencies, build, sign, SBOM, verify, deploy and respond — where three compromises are stopped before they ride through: a public package impersonating the internal northwind-auth-utils, a script fetched from an unreviewed host mid-build, and a latest tag re-pointed to an unverified image. The artifact that reaches production carries a keyless signature, SLSA provenance and a complete SBOM checked by admission control, and when a dependency is compromised, stored SBOMs answer 'are we affected?' in under two minutes instead of four days by hand.

CY-MID-052Mid Level · Software Supply Chain Security

Software Supply Chain Security — The Supply Chain Pipeline

A hands-on mid-level course that secures everything your build trusts. Work the supply chain pipeline - eight stages: Source, Dependencies, Build, Sign, SBOM, Verify, Deploy, and Respond - defending against dependency, build, and artifact tampering with real SLSA, Sigstore, and SBOM work. Strictly defensive. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Secure source and pin, vet, and monitor dependencies.
Harden the build and sign artifacts with provenance (SLSA, Sigstore).
Generate and consume SBOMs and verify before deploy.
Respond to a compromised dependency or build quickly.

Price:৳8,000