Red Hat Trusted Application Pipeline

Shift security left in the software supply chain

red_hat-trusted_application_pipeline-logo-reversed.png

Catch vulnerabilities early with a self-serve developer experience imbued with the organization’s security practices, for distributed teams to comply with security and compliance requirements. Development teams leverage solution templates with integrated security checks to standardize and expedite security-focused golden paths with Red Hat Trusted Application Pipeline. Remove toil in finding and fixing vulnerabilities early. Increase security posture in the CI/CD pipeline with an automated chain of trust that verifies compliance is met.

Red Hat Trusted Application Pipeline validates artifacts signatures, provenance, and attestations to stop suspicious build activity from being promoted.

Red Hat Trusted Application Pipeline is generally available now

Start curating your own trusted content and increase the security posture in your pipelines. With Red Hat Trusted Application Pipeline, increase transparency and trust early in code-time while safeguarding the build systems from a self-serve developer hub:

See what’s new in Red Hat Trusted Application Pipeline  Red Hat Trusted Application Pipeline documentation 

Developer-confidence

Developer confidence

Standardized security-focused golden paths that remove cognitive load to increase developer confidence for ever-evolving security threats.

fix-issues_icon

Fix your issues

Simplify vulnerability management for teams to find and fix issues early without the rework at production and increase service reliability.

increase_trustworthiness_icon

Increase trust

Increase trustworthiness of artifacts to tamper-proof code in software delivery for a chain of custody that ensures software supply chain integrity.

verify-compliance_icon

Verify compliance

Verify pipeline compliance with automated provenance and attestation that prevents suspicious activity from being promoted to improve resiliency.

index_icon

Index images

Automatically index and analyze newly pushed images against vulnerability databases, to report on the latest CVEs in real time and minimize operational risk.

kubernetes-native_security_icon

Kubernetes-native security

Employ Kubernetes-native security controls to enforce security policies for declarative and continuous security that provides for more predictable delivery.

Red Hat Trusted Application Pipeline features

Red Hat Trusted Application Pipeline performs numerous checks on your software artifacts and predefined dependencies for CVEs just as code is written. We also prevent source code injection and image poisoning in your build system each time when pull requests are triggered to merge code for new builds. This means you can:

Magnifying glass on computer

Save time

Save developer time and reduce cognitive load using customizable, validated templates with integrated safeguards to stay compliant with security requirements. Expedite onboarding of security workflows from a centralized, self-managed software catalog backed by an extensive ecosystem of plugins, modular extensions to stay focused on building and shipping code faster.

Prevent malicious code

Prevent and identify malicious code early with dependency analytics that scans software components for vulnerabilities directly from the IDE, to map and evaluate the impact radius of security threats. Generate and manage SBOMs and VEXs stored in a system of record, to index and query security documentation for actionable insights and recommendations.

Safeguard systems

Safeguard build systems from poisoned pipelines with an automated chain of trust for each pull request that validates artifact signatures, attestations, and confirms on the expected build process. Enterprise contracts integrated with cryptographic verification tools, enforce security policies based on SLSA requirements, to continuously deploy to an auditable, immutable state. 

Tamper-proof artifacts

Use tamper-proof software artifacts with digital signatures at every step of the CI/CD workflow through a keyless management system. Enhance transparency and accountability with OpenID Connect integrations for identity-based signing backed by auditable transparency logs from an immutable ledger that’s shared for stronger software supply chain integrity and authenticity.

Analyze images

Constantly analyze images in storage for the latest vulnerabilities to mitigate security risks before releasing images into production. Securely store and share the use of containerized software to development and production from a container registry platform that’s seamlessly integrated into the build system. Distribute Open Container Initiative content including application signatures, SLSA attestations and software bill of materials (ie .sig, .att, .sbom) - all from a trusted image registry.

Monitor your build

Continuously monitor the build environment with vulnerability scanning and policy checking directly from the CI/CD pipeline - no package managers, no wget required. Deliver a robust supply chain security with comprehensive monitoring and threat detection capabilities that proactively identify and mitigate vulnerabilities to ensure the integrity and security of containerized application workload and their Kubernetes environments.

Integrations

Red Hat Trusted Application Pipeline offers flexibility and choice to customers for these self managed, on-premise capabilities to be easily layered onto application platforms like Red Hat OpenShift, or be consumed in parts to meet their developers where they are. Parts such as Red Hat Developer Hub, Red Hat Trusted Profile Analyzer, Red Hat Trusted Artifact Signer that can be sold separately.

Red Hat Developer Hub

Red Hat Developer Hub

An enterprise-grade, open developer platform for building developer portals,...

trusted profile analyser

Red Hat Trusted Profile Analyzer

Use your software assets with confidence. Curate your trusted content by...

Trusted Artifact Signer

Red Hat Trusted Artifact Signer

Enables cryptographic signing, verification of software, and provenance...

Red Hat OpenShift

Red Hat OpenShift

Open, hybrid-cloud Kubernetes platform to build, run, and scale...

Featured resources

Trusted software supply chain

A developer’s guide to setting supply chain security in DevSecOps

Collin Chau +3
Tackling CI/CD Security Anti-Patterns

White paper: Tackling CI/CD Security Anti-Patterns

Getting started with CI/CD Pipeline Security

Analyst brief: Getting started with CI/CD Pipeline Security

A blueprint for supply chain security

A blueprint for supply chain security

Latest blogs & articles

Featured image for Red Hat Trusted Software Supply Chain.
Blog
Sep 26, 2024

Establishing software supply chain security: Jenkins with Red Hat Trusted Artifact...

Akshar Kottuvada

As cyber threats become increasingly sophisticated, organizations need...

Featured image for Red Hat Trusted Software Supply Chain.
Blog
Jul 17, 2024

Red Hat Trusted Application Pipeline - 1.0.2 Maintenance Release

Markus Nagel

1.0.2 Maintenance Release Announcement  In case you were wondering why...

Featured image for Red Hat Trusted Software Supply Chain.
Article
Apr 18, 2024

Red Hat Trusted Software Supply Chain is now available

Markus Nagel

Discover how Red Hat Trusted Software Supply Chain makes it easier to create,...

DevOps
Article
Jul 18, 2023

An introduction to Red Hat Trusted Application Pipeline

Ian Lawson

Discover more about Red Hat Trusted Application Pipeline, a secure and easy...