Trusting Your Ingredients
summary
Argues that provenance and immutability of modules matter more than language hype, showing concrete practices: fetch modules from Athens or a trusted NGO center mirror rather than random USBs, record licenses and avoid rewrites that break consumers, lock dependency versions and run reproducible CI/CD pipelines, and never run git push -F on published history. Recommends keeping module artifacts available, choosing tools that enforce traceability, and treating builds like food recipes so deployments remain reproducible.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:15Ingredients
- 3:16Recipes
- 3:31Misuse of Recipes
- 4:15Immutable
- 4:32Push F
- 5:07Tools
- 5:41Choosing the Right Equipment
- 6:04In the Kitchen
- 6:15Final Thoughts
related talks
30mHow Secure Is Your Build/Server?
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
24mProtecting Ourselves from CNCFgate. Software Supply Cha...
44mWhat does it take to deploy to production with confidence?
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
33mGrowing the Chain: Trusting Build Provenance from Userspace
28mBuilding Images for the Secure Supply Chain
40mSoftware Supply Chain Aspects in Infrastructure as Code, and How to Secure it