Lightning Talk: Repurposed Purpose: Using Git's DAG for Supply Chain Artifact Resolution
summary
GitBOM repurposes Git’s Merkle DAG so git object IDs become canonical, unique, immutable artifact IDs that link every source file through build outputs into a language‑heterogeneous dependency tree. Proofs of concept exist for LLVM, GCC, ld, Go and a bomsh s-trace approach; build tools embed a compact tree ID (for example in a Docker manifest) with zero developer workflow change. If CVE databases include git OIDs, those artifact trees can be efficiently cross‑referenced to find vulnerable binaries.
AI-written summary · about
chapters (10)
- 0:00Repurposed purpose of Git
- 1:03Software trust and supply chain
- 2:47Software artifact questions
- 4:33Git object IDs for identity
- 5:38Merkle trees in Git
- 6:20Git OID for artifacts
- 7:03SBOMs with GitBomb trees
- 7:45GitBomb for artifact tracking
- 9:11Proof of concepts
- 10:13Q&A
related talks
35mRepurposed Purpose: Using git's DAG for Supply Chain Artifact Resolution
43mGitBOM: Repurposing Git’s Graph for Supply Chain Security & Transparency
20mDo You Know What's in the Software You Run? Introducing GitBOM
31mOmniBOR: Bringing the Receipts for Supply Chain Security
41mOmniBOR: Bringing the Receipts for Supply Chain Security
35mAchieving End-To-End Software Supply Chain Security With in-toto
15mFinding Your Way: A Survey of Supply Chains
06mLightning Talk: DevSecOps for C++? Keep Calm and use Conan