.NET Supply Chain Beneath the Surface
summary
A .NET project that lists two packages often expands to dozens of transitive packages; the talk shows command-line tools that find, update and report those exact extras. Use depends to visualize the full graph, snitch to detect unnecessary transitive entries, and packcheck or dotnet-outdated to list and auto-update stale versions. Generate SBOMs with Microsoft’s sbom tool, CycloneDX, or Covenant (which also outputs HTML and converts formats) and send results to Azure Log Analytics from CI for org-wide querying.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker intro
- 1:55Investigating dependencies in .NET
- 6:55Tools to visualize dependencies
- 10:28Updating outdated dependencies
- 13:39Reporting dependencies for compliance
- 18:17Software Bill of Materials (SBOM)
- 23:57Summary and Q&A
related talks
56m.NET supply chain: Protecting against hidden threats
57m.NET supply chain: Protecting against hidden threats
46m.NET supply chain: Protecting against hidden threats
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
58mSecuring your .NET application software supply chain
23mSupply Chain Security using Free and Open Tools
21mSecuring Diverse Supply Chains Across Interconnected Systems
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?