Trusted Open Source Artifacts on the Blockchain: A Hands-on Introduction to Pyrsia
summary
A decentralized package network called Pyrsia rebuilds artifacts from source on independent nodes, requires consensus across build nodes, and writes a tamper-evident record to a blockchain transparency log. Demo installs a Pyrsia daemon, points Docker at localhost, pulls Alpine, and shows syslog and Docker inspect JSON proving the built artifact and builder node IDs; mismatched builds are rejected. Several large vendors operate nodes (Docker Hub, JFrog, Oracle, Huawei) and the system works end-to-end in the demo.
AI-written summary · about
chapters (8)
- 0:00Pyrsia introduction
- 1:24What we’ll cover by the end of the talk
- 2:06What Pyrsia is
- 4:15Why Pyrsia exists
- 6:43How Pyrsia works
- 8:37Live Pyrsia demo
- 13:28Pyrsia build nodes
- 14:35Key takeaways
related talks
26mand Pyrsia: Securing the Software Supply Chain
29mClosing the Supply Chain Security Loop with Rust & Pyrsia
51mA Community Approach to OSS Distribution
10mHacking the OSS Supply Chain
30mSupply Chain Security for OpenSource Projects
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
40mSoftware Supply Chain Aspects in Infrastructure as Code, and How to Secure it
28mBuilding Images for the Secure Supply Chain