Add notes on chainguard

Author: RobKenis

docs/edgecase-2025/6-vulnerability-chaos.md

@@ -0,0 +1,45 @@
+# Taming Vulnerability Chaos
+
+> Taming vulnerability chaos across the multiverse of kubernetes and edge
+
+## The problem
+
+From virus scanners to binary scanners, they scan binary signatures, file patterns and resource usage. CVE scanners
+have a package database and do some metadata analysis. They differ in scanning techniques.
+
+### Demo - Scanner comparison
+
+When you do scanning on images, use digest pinning and always assume that image tags are mutable.
+When scanning images with Grype and Trivy, they differ in output, most notably on the vulerabilities without a fix.
+Trivy does not support vulnerabilities without a fix for alpine. This gives a false sense of security.
+
+### Demo - SBOMs
+
+Software Bill Of Materials describe all software and dependencies used. Why do this? When the next _log4j_ happens,
+you can quickly analyze where the code is used and which applications are impacted.
+
+### Demo - Metadata manipulation
+
+Some humans blindly trust scan results. Zero CVEs, let's use it! The demo shows that you can rename files in your image
+so they no longer match the CVE database. Now your image has 0 CVEs.
+
+### Demo - Sigstore
+
+When pusing the image to the registry, sign the digest because tags are mutable. Use sigstore in combination with Kubernetes
+admission controller to validate the images are not tampered with.
+
+## Conclusion
+
+- Supply chain security starts at the source
+    - Generate SBOM during the build (apko and melange)
+- Use full provenance using sigstore
+- Reach level 3 SLSA
+
+## Links
+
+- <https://www.chainguard.dev/>
+- <https://github.com/aquasecurity/trivy>
+- <https://github.com/anchore/grype>
+- <https://www.chainguard.dev/unchained/introducing-wolfi-the-first-linux-un-distro-designed-for-securing-the-software-supply-chain>
+- <https://www.sigstore.dev/>
+- <https://slsa.dev/>

docs/edgecase-2025/7-chainguard-workshop.md

@@ -0,0 +1,25 @@
+# Workshop - Chainguard
+
+Traditional open source is an insecure foundation for software development. The current
+status of CVE management is deeply broken. You pull an upstream image, scan it, and then
+filter through 100 CVEs.
+
+> Shift left? More like shift the blame!
+
+## Building Docker images
+
+Don't use single stage docker builds. Multi-stage is better because no build dependencies are
+present in the final image. APKO + Melange is the ideal way according to Chainguard.
+
+## Best practices
+
+- Pin by digest, for immutability
+- Sign with Sigstore, for provenance and trust
+- Build SBOMs, for visibility and compliance
+- Enforce in CICD, for shift-left ~blaming~ security
+- Use admission policies, for guardrails at runtime (with Gatekeeper/Kyverno)
+
+## Links
+
+- <https://github.com/chainguard-dev/apko>
+- <https://images.chainguard.dev/directory/image/wolfi-base/versions>