Skip to content

Add blog post about Conforma demo from Red Hat Summit 2026 #548

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Acepresso wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add blog post about Conforma demo from Red Hat Summit 2026 #548

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions website/content/posts/rh-summit-2026-license-policies.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
---
title: "Red Hat Summit 2026: From SBOM to Enforcement — Writing License Policies with Conforma"
date: 2026-08-19T10:00:00+01:00
author: "Luiz Carvalho"
---

We're excited to share that Conforma was featured at Red Hat Summit 2026. The talk demonstrates writing a Conforma policy rule from scratch to solve a real-world license compliance challenge.

<!--more-->

## The Challenge: License Compliance at Scale

Your legal team mandates "no AGPL" in container images. With hundreds of packages per image, manual checking doesn't scale across multiple teams, constant updates, and the inevitable special cases where specific packages have been individually approved. Organizations need automated enforcement — not just data collection.

## From First Rule to Production-Ready

The demo walks through writing a license policy rule using Rego, starting with a straightforward rule and evolving it commit by commit. Violation messages become more specific. Exceptions handle approved packages. The policy extends to work with SBOMs from multiple sources. Each change is small and purposeful, showing how Conforma and Rego turn requirements into enforceable rules.

## Watch the demo

@fullsend-ai-review fullsend-ai-review Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] naming-conventions

Section heading 'Watch the demo' uses lowercase 'demo', inconsistent with the Title Case convention used in all other blog posts' section headings (e.g., 'Watch the Recording', 'Watch the Episode').

Suggested fix: Change to '## Watch the Demo'.

Watch a license policy evolve from a simple rule to production-ready enforcement. The demo recording and presentation slides are now available on our Resources page.

**[Watch "From SBOM to Enforcement: Writing License Policies with Conforma"](/resources/#from-sbom-to-enforcement-writing-license-policies-with-conforma)**

@fullsend-ai-review fullsend-ai-review Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] structural-consistency

The two most recent blog posts announcing resource entries end with a closing line encouraging readers to explore other resources. This new post ends immediately after the bold link with no such line.

Suggested fix: Add a closing line after the bold link, e.g.: 'While you're there, explore our collection of other conference presentations, demos, and educational content about securing software supply chains with Conforma.'

18 changes: 18 additions & 0 deletions website/content/resources/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,24 @@ Whether you're just getting started with supply chain security or looking to dee

These conference presentations, demos, educational videos and articles showcase how organizations are using Conforma to secure their software supply chains.

## From SBOM to Enforcement: Writing License Policies with Conforma

@fullsend-ai-review fullsend-ai-review Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] content structure consistency

The new resource entry omits the {{< rawhtml >}} embedded media block that most other resource entries include. However, this is consistent with existing precedent -- the 'How we use software provenance at Red Hat' article entry also omits the rawhtml block because it links to an external article rather than an embeddable video. The Google Drive recording link is not straightforwardly embeddable via iframe the same way YouTube videos are.

Suggested fix: If a Google Drive embed iframe or YouTube mirror is available, adding a rawhtml block would improve visual consistency with the video entries. Otherwise, no change is needed.


**Speaker:** Luiz Carvalho, Red Hat
**Event:** Red Hat Summit 2026
**Format:** Conference Talk
**Link:** [Watch the recording](https://drive.google.com/file/d/1jjenSejDC3gOBsHd1u9DL6JwW3vU0N81/view?usp=drive_link)

@simonbaird simonbaird Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All the other videos are shown with an embeded player. Can we make this one consistent with the others?

@simonbaird simonbaird Aug 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm looking at https://274f1dd4.enterprise-contract.pages.dev/resources/ .

**Slides:** [View presentation](https://docs.google.com/presentation/d/1NGYiquWHK9sLXqJktsm02Zs9fv3vuiCA-u4mOIbFXvU/edit?usp=sharing)
**Demo repository:** [summit-demo-2026-sbom-conforma](https://github.com/lcarva/summit-demo-2026-sbom-conforma)

This talk demonstrates turning a legal mandate into automated policy enforcement using Conforma. Starting from a real-world scenario, a license policy is written from scratch and evolved step by step. This talk covers:

- The problem: when your legal team says "no AGPL" but manual checking doesn't scale
- Working with SBOMs from multiple sources
- The Conforma workflow: SBOM or image + policy → enforcement result
- Step-by-step demo: writing a license policy rule and evolving it to handle real-world requirements

*Great starting point for anyone looking to write their first Conforma policy.*

@fullsend-ai-review fullsend-ai-review Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] structural-consistency

Most existing resource entries use an introductory sentence followed by a bulleted list of topics covered. The new entry uses only prose paragraphs, breaking the established pattern.

Suggested fix: Convert the description into the established format: a short introductory sentence followed by a bulleted list of key topics covered in the talk.


## Ask an OpenShift Expert Ep 169 | Red Hat Trusted Artifact Signer - Conforma

**Speakers:** Veda Shankar, Stefano Pentassuglia & Joe Stuart, Red Hat
Expand Down
Loading