Sofware Supply Chain Security Is Hard. But Does it Need to Be?
summary
Argues that developers must sign commits with SSH keys and enable two‑factor authentication right away; recommends generating and regularly scanning SBOMs so dependencies with fixes are found — the talk claims ~96% of vulnerable downloads already had fixes and cites a spike where ~20% of certain Log4j versions were malicious. Describes SALSA provenance attestations, a Jenkins plugin to emit those attestations, and an AutoDoog control‑plane dashboard that audits repo settings and monitors supply‑chain posture.
AI-written summary · about
chapters (11)
- 0:00Software supply chain risks
- 2:12Trust in dependencies
- 4:21What is supply chain
- 5:25Signing commits and 2FA
- 7:13SBOMs and vulnerability checks
- 10:28Provenance attestations
- 13:18Mitigating threats with Git
- 14:45AutoDoog for visibility
- 16:13Supply chain security control plane
- 18:46Key takeaways
- 20:35Call to action
related talks
39mOpen Source Software Supply Chain Security — Why does it matter?
15mSoftware Supply Chain Security for those in a rush
41mManaging the Risk of Software Supply Chain Attacks
14mSupply Chain Security, why should I care?
39mSoftware Supply Chain Security
25mYour Software Supply Chain is Only as Secure as its Weakest Link
37mSupply Chain Attacks and the Future of Software Delivery
36mBuilding a Trusted and Resilient Software Supply Chain