#7 Open Source Forum 2019 Dan Lorenc
summary
Describes concrete supply‑chain failures and fixes: a recent attack removes 17 PyPI packages via typo‑squatting (jellyfish vs jellfish) that download payloads and exfiltrate GPG/SSH keys, and typical npm installs pull ~50 packages (≈5,000 lines) of unknown code. Proposes standards and tooling: Tectonic declarative pipelines with signed step metadata, plus Grafeas API and in‑toto provenance, SBOMs/SPDX for authorship and rebuilds, and a community metadata bus to query and enforce policies.
AI-written summary · about
chapters (5)
- 0:00Start
- 7:44Delivery Pipeline
- 14:17Pipeline Definitions
- 14:51Reflections on Trusting Trust
- 18:11Tectonic Pipelines
related talks
32mHacking the OSS Supply Chain
25mTrusting Your Open-Source Software Supplier
30mSecuring Open Source Supply Chains
43mHow to hack and defend (your) open source
30mSecuring the Open Source Software Supply Chain
49mTrustworthy Open Source: The Consequences of Success
16mAre we Forever Doomed to Software Supply Chain Security?
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...