Securing your .NET application software supply-chain
summary
Explains concrete defenses: shows SolarWinds and CodeCov as real failures, demonstrates making .NET builds deterministic (difference came from PDB paths, fixed by disabling debug symbols and using the dotnet-reproducible package), generates a CycloneDX SBOM for transitive deps, produces SLSA level 3 provenance signed via sigstore short-lived signing, and wires CI to verify artifacts so builds, SBOMs and provenance can be routinely validated.
AI-written summary · about
chapters (15)
- 0:00Securing .NET supply chains
- 1:11Software supply chain risks
- 4:00Software supply chain definition
- 7:55Developer source code risks
- 13:53Third-party dependency risks
- 22:14Reproducible builds importance
- 27:15Deterministic .NET builds
- 31:50Signing artifacts with Sigstore
- 36:52Automotive supply chain analogy
- 38:39SBOM explained
- 41:47SLSA for supply chain security
- 44:15Demo: SLSA provenance
- 50:21Tools for supply chain security
- 54:12Conclusion and recommendations
- 55:38Q&A on dependency auditing
related talks
58mSecuring your .NET application software supply chain
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
56m.NET supply chain: Protecting against hidden threats
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
29mState of the secure software supply chain
36mBuilding a Trusted and Resilient Software Supply Chain
39mReflections on Trust in the Software Supply Chain
57m.NET supply chain: Protecting against hidden threats