Securing your .NET application software supply chain
summary
Shows concrete fixes: a binary diff demo finds non-reproducible DLLs caused by PDB paths and resolves them by embedding symbols and using dotnet-reproducible / reproducible.isolated and SourceLink so builds are bit-for-bit reproducible builds. Demonstrates GitHub Actions + OIDC + cosign keyless signing (short-lived certs) to sign artifacts, and generating an SBOM (CycloneDX) plus following SLSA levels. Cites 10,000 car parts/2,700 suppliers analogy and a Veracode stat that ~80% of added dependencies rarely change. Discusses Tekton/attestations and rerunning builds to detect tampering.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:41Securing your .NET application software supply chain
- 4:54What is a Supply Chain?
- 11:37GIT Commit Signing
- 14:09Octopus Scanner - NetBeans
- 14:58Visual Studio Code
- 19:53Dependency Confusion
- 24:093rd Party Libraries
- 25:35Security Scorecards - OpenSSF
- 27:17Source Generators
- 30:55Reproducible Build .NET
- 37:31Signing artifacts
- 43:30Automotive Industry
- 43:48Car Supply Chain
- 48:06SolarWinds Project Trebuchet
- 50:46IBM OpenShift
- 52:49Azure Pipelines Artifact Policy
- 53:39Google SLSA
related talks
58mSecuring your .NET application software supply-chain
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
56m.NET supply chain: Protecting against hidden threats
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
30mSecuring Open Source Supply Chains
57m.NET supply chain: Protecting against hidden threats
46m.NET supply chain: Protecting against hidden threats