Repurposed Purpose: Using git's DAG for Supply Chain Artifact Resolution
summary
Proposes a way to get a complete, reproducible tree for any binary, shared object, container or class file by using GitBOM built from git object ids, letting build tools embed those IDs into outputs so vulnerability scanners can deterministically trace every source byte (example: Log4Shell maps back to a single .java file). Provides working PoCs (LLVM/clang/lld, Go, Rust), a simple CLI generator, SPDX/CycloneDX integration and signed artifacts for provenance; community launched and tooling is already available.
AI-written summary · about
chapters (8)
- 0:00Start
- 6:30Simplifying perspective change
- 6:47Simple Questions
- 7:28Identity: what is this software artifact?
- 10:33Identity: non-solutions
- 15:30Dependency: what is in this artifact?
- 18:55Metadata: what is known about it?
- 23:24post-hoc scanning?
related talks
11mLightning Talk: Repurposed Purpose: Using Git's DAG for Supply Chain Artifact Resolution
43mGitBOM: Repurposing Git’s Graph for Supply Chain Security & Transparency
20mDo You Know What's in the Software You Run? Introducing GitBOM
41mOmniBOR: Bringing the Receipts for Supply Chain Security
35mAchieving End-To-End Software Supply Chain Security With in-toto
31mOmniBOR: Bringing the Receipts for Supply Chain Security
15mFinding Your Way: A Survey of Supply Chains
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...