iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The September 2021 Linux Foundation webinar “Continuous…Everything? Integration, Packaging, Delivery, And Security All In One!” explored how security checks can connect software dependencies, packaging, CI/CD pipelines, and deployment—not how one product combines every function. Its agenda covered finding and remediating vulnerabilities in dependencies and container images, controlling package sources, continuous packaging in a CircleCI pipeline, and using provenance and security gates before deployment.
What the webinar covered
The Linux Foundation records the webinar as held on September 8, 2021. Snyk sponsored it, and the listed speakers were Tomas Gonzalez, Partner Solutions Architect at Snyk; Rebekah Whittle, Solutions Engineer at CircleCI; and Tom Gibson, Senior Staff Engineer at Cloudsmith. Cloudsmith published its announcement on September 9, 2021. The event date, participants, and agenda are historical details; they do not establish the products’ current capabilities.
The discussion connected several stages of software delivery. Teams bring in third-party libraries and other components, build those alongside custom code, package the result, and then promote or deploy it. Security controls can be applied at each transition rather than left to a final check.
How security fits across the delivery workflow
Assess inputs before building
Applications rely on inputs such as libraries, runtimes, databases, and container base images. The webinar’s agenda included discovering and remediating vulnerabilities in dependencies and container images. Checking these inputs helps teams identify known risks before they become part of a build, although the event listing does not specify particular scanners, coverage, or remediation results.
Control where packages come from
A controlled package source—a repository that serves as a “source of truth”—can help teams manage which open-source packages are available to their workflows and retain provenance information. The webinar announcement also framed trusted package sources as a defense against malicious packages. This is a workflow concept in the event materials, not evidence of a particular product’s effectiveness.
#1 Best Overall
Connect packaging to CI/CD
The announced agenda included integrating continuous packaging and security into a CircleCI delivery pipeline. In practical terms, automation can run checks as artifacts are built or packaged, so a result can inform whether an artifact proceeds. The event materials establish that this integration was a topic; they do not document a tested configuration or a current, step-by-step setup.
Gate promotion and deployment
Provenance can provide evidence about an artifact’s origin and path through the build process. Deployment workflows can use that evidence, alongside security policy checks, to decide whether an artifact is eligible for promotion or deployment. The webinar agenda called out provenance and security quality gates, but does not define specific policies, thresholds, or implementation details.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhy the assembly-line analogy matters
Cloudsmith author Tom Gibson wrote, “Application delivery pipelines share many traits with any assembly line.” In the accompanying explanation, software components are inputs that teams assess before combining them with custom code and moving the resulting artifacts through delivery. The analogy highlights why checks need to connect: a secure build can still be undermined if untrusted inputs enter the workflow or if deployment ignores the artifact’s provenance.
Cloudsmith’s September 9, 2021 announcement also asserted that open-source components make up “more than 80% of modern codebases.” The announcement does not identify an underlying study or methodology, so this should be read as Cloudsmith’s 2021 claim, not as a current independently established statistic.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Questions to ask when evaluating a similar workflow
The event materials describe topics rather than establish comparative product capabilities. For a real implementation review, use questions like these to define what needs to be verified:
- Coverage: Which languages, package formats, dependencies, and container images are in scope?
- Vulnerability handling: Can the workflow discover known vulnerabilities, and how do teams prioritize and remediate findings?
- Package-source controls: Can teams restrict or manage package sources to reduce exposure to untrusted or malicious packages?
- CI/CD integration: Where do checks run in the build and packaging pipeline, and what happens when a check fails?
- Provenance and policy: What evidence is retained about an artifact’s origin, and which rules determine whether it may be promoted or deployed?
Those are evaluation criteria grounded in the webinar’s announced agenda, not claims that the participating vendors meet them today. The sources do not provide a comparative product test, feature specifications, pricing, or current availability.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
Sources
- Linux Foundation webinar listing — event date, sponsor, speakers, and announced agenda.
- Cloudsmith’s September 9, 2021 announcement — webinar framing, assembly-line analogy, and the attributed open-source percentage claim.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
