BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.devcon.org//devcon8//speaker//RB8RDV
BEGIN:VTIMEZONE
TZID:IST
BEGIN:STANDARD
DTSTART:20000101T000000
RRULE:FREQ=YEARLY;BYMONTH=1
TZNAME:IST
TZOFFSETFROM:+0530
TZOFFSETTO:+0530
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-devcon8-7CUG3V@cfp.devcon.org
DTSTART;TZID=IST:20261105T114500
DTEND;TZID=IST:20261105T120000
DESCRIPTION:Every container image you pull carries a risk - hundreds of pac
 kages you didn't explicitly ask for\, vulnerabilities you'll spend weeks t
 riaging\, and no proof of how it was built. What if you could start from a
  base image that ships with near-zero CVEs\, includes only what your appli
 cation needs to run\, and provides cryptographic evidence of its entire bu
 ild process?\n\nProject Hummingbird [1] is an open source initiative that 
 produces minimal\, hardened container images built from Fedora sources. Ev
 ery image is distroless by design\, built in a SLSA Level 3 pipeline (Konf
 lux)\, ships with a signed SBOM\, and is reproducible -- you can rebuild i
 t locally and verify you get the same bytes. The images are free\, redistr
 ibutable.\n\nThis talk introduces Project Hummingbird [1] to an audience t
 hat cares about container security.\n\nKey Takeaways\n\n- You can start us
 ing near-zero CVE\, distroless container images today\n\n- Supply chain tr
 ust (SLSA3\, SBOMs\, signatures) is built into every Hummingbird image by 
 default\n\n- The distroless approach doesn't mean giving up usability\n\n-
  Hummingbird images are reproducible: you can independently verify what yo
 u're running\n\n- This is open source\, built from Fedora\, and redistribu
 table\n\n[1] [https://fedoraproject.org/wiki/Hummingbird](https://fedorapr
 oject.org/wiki/Hummingbird)
DTSTAMP:20261101T132255Z
LOCATION:Community Led Stage
SUMMARY:Project Hummingbird - Minimal Images\, Maximum Trust - Gaurav Kamat
 he
URL:https://cfp.devcon.org/devcon8/talk/7CUG3V/
END:VEVENT
END:VCALENDAR