From 5440acefaa1ba665608b300a992a4fcd1f577be0 Mon Sep 17 00:00:00 2001 From: ghartuv Date: Mon, 24 Aug 2026 18:07:49 +0300 Subject: [PATCH] Add blog post about Conforma demo from Red Hat Summit 2026 Add blog post and resource entry for the Conforma demo presented at the Red Hat Summit 2026 event. Co-Authored-By: Claude Sonnet 4.5 Ref: https://redhat.atlassian.net/browse/EC-1988 --- .../posts/rh-summit-2026-license-policies.md | 24 +++++++++++++++++++ website/content/resources/_index.md | 18 ++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 website/content/posts/rh-summit-2026-license-policies.md diff --git a/website/content/posts/rh-summit-2026-license-policies.md b/website/content/posts/rh-summit-2026-license-policies.md new file mode 100644 index 00000000..8adc66df --- /dev/null +++ b/website/content/posts/rh-summit-2026-license-policies.md @@ -0,0 +1,24 @@ +--- +title: "Red Hat Summit 2026: From SBOM to Enforcement — Writing License Policies with Conforma" +date: 2026-08-19T10:00:00+01:00 +author: "Luiz Carvalho" +--- + +We're excited to share that Conforma was featured at Red Hat Summit 2026. The talk demonstrates writing a Conforma policy rule from scratch to solve a real-world license compliance challenge. + + + +## The Challenge: License Compliance at Scale + +Your legal team mandates "no AGPL" in container images. With hundreds of packages per image, manual checking doesn't scale across multiple teams, constant updates, and the inevitable special cases where specific packages have been individually approved. Organizations need automated enforcement — not just data collection. + +## From First Rule to Production-Ready + +The demo walks through writing a license policy rule using Rego, starting with a straightforward rule and evolving it commit by commit. Violation messages become more specific. Exceptions handle approved packages. The policy extends to work with SBOMs from multiple sources. Each change is small and purposeful, showing how Conforma and Rego turn requirements into enforceable rules. + +## Watch the demo + +Watch a license policy evolve from a simple rule to production-ready enforcement. The demo recording and presentation slides are now available on our Resources page. + +**[Watch "From SBOM to Enforcement: Writing License Policies with Conforma"](/resources/#from-sbom-to-enforcement-writing-license-policies-with-conforma)** + diff --git a/website/content/resources/_index.md b/website/content/resources/_index.md index 893a79d2..283ee938 100644 --- a/website/content/resources/_index.md +++ b/website/content/resources/_index.md @@ -6,6 +6,24 @@ Whether you're just getting started with supply chain security or looking to dee These conference presentations, demos, educational videos and articles showcase how organizations are using Conforma to secure their software supply chains. +## From SBOM to Enforcement: Writing License Policies with Conforma + +**Speaker:** Luiz Carvalho, Red Hat +**Event:** Red Hat Summit 2026 +**Format:** Conference Talk +**Link:** [Watch the recording](https://drive.google.com/file/d/1jjenSejDC3gOBsHd1u9DL6JwW3vU0N81/view?usp=drive_link) +**Slides:** [View presentation](https://docs.google.com/presentation/d/1NGYiquWHK9sLXqJktsm02Zs9fv3vuiCA-u4mOIbFXvU/edit?usp=sharing) +**Demo repository:** [summit-demo-2026-sbom-conforma](https://github.com/lcarva/summit-demo-2026-sbom-conforma) + +This talk demonstrates turning a legal mandate into automated policy enforcement using Conforma. Starting from a real-world scenario, a license policy is written from scratch and evolved step by step. This talk covers: + +- The problem: when your legal team says "no AGPL" but manual checking doesn't scale +- Working with SBOMs from multiple sources +- The Conforma workflow: SBOM or image + policy → enforcement result +- Step-by-step demo: writing a license policy rule and evolving it to handle real-world requirements + +*Great starting point for anyone looking to write their first Conforma policy.* + ## Ask an OpenShift Expert Ep 169 | Red Hat Trusted Artifact Signer - Conforma **Speakers:** Veda Shankar, Stefano Pentassuglia & Joe Stuart, Red Hat