OSS Supply Chain Security
summary
Regulation drives an explosion of SBOMs everywhere but most are low fidelity and unmaintained so they become noise not wisdom, signing and identity must bind inventories to authors yet current tooling is unusable; Google-backed tools aim to fix that: OSV synthesizes disparate vulnerability databases into a simple API that actually answers “is this artifact vulnerable” and GUAC builds a provenance/hypergraph to correlate attestations like VEX and Salsa so policy engines can make real decisions.
AI-written summary · about
chapters (9)
- 0:00Open source security intro
- 1:57Supply chain attacks and regulations
- 3:42SBOMs as ingredient lists
- 5:28SBOM data risks
- 7:11Digital signatures for SBOMs
- 8:34Tools for security signals
- 9:15OSV vulnerability database
- 9:57GUAC artifact analysis
- 10:38Call to action
related talks
37mSecuring OSS across the whole supply chain and beyond
14mKeynote: The Next Steps in Software Supply Chain Security
44mImproving the Software Supply Chain Security
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
40mPractical guides for enhacing your Software Supply Chain Security
22mSBOM and Security Transparency - How it all fits together
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
40mImproving Supply Chain Integrity with Ope...