Securing Open Source Supply Chains
summary
Explains why inconsistent repo practices break provenance and points to concrete fixes: SolarWinds Sunburst as an example of a compromised DLL and an npm typo attack that exfiltrated env secrets via GitHub Actions; prescribes adoption of SLSA levels 1–4 for source and build integrity; demonstrates signing and transparency with Sigstore: Fulcio, Rekor, Cosign and optional Tekton Chains integration; shows generating SBOMs in common formats and using OpenSSF-aligned policies to gate deployments.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:41SolarWinds attack
- 2:51threatens to disrupt open source
- 3:56study of composite elements
- 4:26like regular supply chains, but for software
- 18:28Supply chain Levels for Software Artifacts
- 21:32SLSA prescribes "levels"
- 27:38TEKTON CHAINS
- 29:53information traverse the supply chain
related talks
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
39mOpen Source Software Supply Chain Security — Why does it matter?
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
15mSoftware Supply Chain Security for those in a rush
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue
37mSecuring OSS across the whole supply chain and beyond