Keynote: The Next Steps in Software Supply Chain Security
summary
Industry builds strong provenance: SLSA and Tekton produce rich SBOMs and attestations, and standards like SPDX and CycloneDX plus VEX are arriving. The problem now is consumption — 300MB SBOMs that nobody can query — so work focuses on aggregation and synthesis (Graph Understanding Artifact Composition, deps/repology, OCI-attached SBOMs) plus policy translation into actionable checks (reactive, preventative, proactive) using OPA/Kyverno and a supply chain working group that meets weekly.
AI-written summary · about
chapters (6)
- 0:00Software supply chain security intro
- 1:46Progress in security tools
- 3:54Consuming software metadata
- 6:03Aggregating supply chain metadata
- 10:01Defining supply chain policies
- 13:13Conclusion
related talks
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
12mKeynote: A Vision for a Secure Software Supply Chain
37mSecuring OSS across the whole supply chain and beyond
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
11mOSS Supply Chain Security
44mImproving the Software Supply Chain Security
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
32mSoftware Supply Chain Security