Supply Chain Security for OpenSource Projects
summary
Shows concrete controls: adopt SLSA levels and build-info to produce SBOMs, centralize binaries in Artifactory and scan metadata with X‑Ray, and shift left into IDEs and CI using jfrog CLI and plugins. Describes a peer‑to‑peer build/distribution prototype called persia and why a CI compromise led to ~15,000 effected customers in SolarWinds. Recommends starting with static scans of dependencies and binaries, collecting fingerprints and transitive metadata, and keeping an auditable on‑demand report store.
AI-written summary · about
chapters (9)
- 0:00Supply chain security intro
- 3:26Supply chains under attack
- 8:02SLSA security levels
- 10:09Four pillars of security
- 15:45Focus on binaries and dependencies
- 18:16Shift left security scanning
- 21:03SolarWinds hack and SBOM
- 23:30IDE and CLI scanning
- 28:45Summary and resources
related talks
54mSupply Chain Security for OpenSource Projects
23mSupply Chain Security using Free and Open Tools
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
39mReflections on Trust in the Software Supply Chain
29mSupply Chain Security: Threats, Defenses And What You Can Do
30mSecuring Open Source Supply Chains
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?