Supply chain — Cosign signing, Rekor transparency log and SLSA — CI/CD, GitOps, DevSecOps & Observability

Supply chain attacks compromise software not by attacking the application directly, but by attacking the tools, libraries, or build infrastructure used to produce it. The SolarWinds attack injected malicious code into the build pipeline. The XZ Utils backdoor was introduced through a long-term social engineering campaign against an open-source maintainer. The npm event-stream compromise happened when a malicious maintainer was granted publish access and published a backdoored version. In each case, users who trusted the software supplier were compromised through the supplier, not through their own code.

Three technologies address supply chain security for container images: Cosign for cryptographic signing that binds an image to its origin, the Rekor transparency log for an immutable public record of every signing event, and SLSA—Supply-chain Levels for Software Artefacts—for a framework of provenance attestations that prove how and where software was built. Together they answer the fundamental question: 'Can I verify that this image was built from this source code by this pipeline and has not been modified since?'

Analogy🏏Cricket

Think of it like cricket: Imagine the BCCI's team management system for an international tour with matches in three different countries simultaneously. Rather than a coordinator manually managing each match day's logistics, the system reads the official tour schedule document and automatically dispatches the right squad, equipment, and support staff to each venue. When the tour schedule changes—a match is rescheduled, a squad member is replaced—the system detects the change and updates the arrangements automatically. Just as the tour management system uses the official document as the source of truth and orchestrates multiple concurrent deployments to multiple venues, ArgoCD uses the Git repository as the source of truth and orchestrates multiple concurrent Application syncs to multiple clusters. Just as the system provides a dashboard showing which venues are 'ready', 'delayed', or 'degraded', ArgoCD provides a dashboard showing which Applications are Synced, OutOfSync, or Degraded. This reveals why ArgoCD is valued at scale: managing dozens of applications across multiple clusters manually is operationally equivalent to coordinating an international cricket tour by phone.