Workshop Complete

Congratulations — you have walked the full trusted software supply chain on a dedicated OpenShift cluster.

What you proved

By completing all seven tracks, you demonstrated that you can, on a fresh cluster:

  1. Hummingbird — verify a published base digest from a trust policy you filled, then mirror it with oc-mirror and verify the internal digest.

  2. Lightwell — author settings.xml so Maven resolves Validated and Remediated coordinates from an enterprise proxy, and record the remediated GAV from an OSV fixed event.

  3. Source — own the application repo on in-cluster Gitea, bind the Hummingbird digest and the exact Lightwell version, and merge a live Renovate PR.

  4. Hermetic build — enforce the source forbid-list, wire the prefetch task, tighten build-namespace NetworkPolicy, and produce a BuildConfig image with SBOM.

  5. Signed image — sign keylessly with RHTAS and verify; then add and verify the admission-key signature for the same image.

  6. Production — admission rejects unsigned images; the signed digest is committed to the prod GitOps repo and Argo CD prod Application is Healthy.

  7. Compliance — TPA holds the promoted image’s inventory and the sample OSV advisory. Your report compares the exact Lightwell version with OSV and locally inspected OpenVEX, and records an ACS policy assessment of the promoted image, including any rejection. LW-DEMO-0002 is a workshop sample, not a real CVE.

Your application signatures and Conforma reports do not establish build provenance. The seeded remediated JAR retains upstream class files, so this exercise demonstrates version selection and sample advisory interpretation rather than a real security patch. OpenVEX stays local; TPA receives the application and library CycloneDX documents and sample OSV. Your ACS result is a point-in-time assessment of one image, not organization-wide continuous monitoring.

GitOps selects the deployed digest. The runtime PublicKey policy checks the admission key and signed repository identity across the protected repositories; it does not require the recorded Fulcio subject or allow only that digest.

Next steps