Bringing Continuous Delivery to Open Source
summary
Shows that many projects ship with tiny teams and huge hidden risk — e.g. a typical web app pulls in >1,000 npm dependencies and pandas has 1,400 committers but four active maintainers — and that a Kubernetes platform build ran 49 configurations with eight hour pipelines turning a release into a three day effort. Describes concrete defenses: Persia: peer-to-peer reproducible builds with randomized multi-node verification and a provenance log, Sigstore and Notary for package signing, Tekton Chains for end‑to‑end verification, and work on reproducible builds and SBOMs.
AI-written summary · about
chapters (6)
- 0:00Start
- 7:23Open source is the Infrastructure
- 9:38Open Source Software
- 13:43For Liquid Software...
- 19:36Pyrsia Provenance Log
- 21:03Vulnerability Management
related talks
41mAll Things Continuous
26mSoftware Delivery from First Principles
39mManaging an Open Source Project
55mContinuously Delivering Continuous Delivery
30mModern Continuous Delivery
31mSoftware Delivery and the Rube Goldberg Machine: What Is the Problem We Are Trying to Solve?
41mContinuous delivery in 10 easy mistakes
45mPanel Discussion: Managing Open Source...