Supply Chain Armoring: Tools and Techniques for Open Source Projects
summary
SolarWinds-style supply chain risks require concrete steps: map the build flow and assets using the salsa levels model and produce a threat model (architecture, assets, adversaries, mitigations), run automated CVE checking in CI (use the cvn cv bin tool as an open option), harden builds toward hermetic/reproducible practices, and adopt provenance verification like in_toto metadata or a triple-build comparison (cloud/on‑prem/other) to detect injected artifacts; expect tooling learning curves but measurable reduction in attack surface.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:25My perspective
- 3:17Why is this an urgent issue
- 4:05Why open source is important
- 8:21US Executive Order
- 9:31Timeline
- 9:57Critical Software
- 12:16Administratively separate builds
- 13:27Grumpiness
- 14:24Analysis
- 14:54Threat Model
- 19:11Salsa
- 20:34Levels
- 24:53Salsa Map
- 25:55Open Source Tools
- 26:57Dependencies
- 28:32The Dilemma
- 31:32CVN
- 37:33Automation
- 39:12Summary
related talks
54mSupply Chain Security for OpenSource Projects
37mSupply Chain Attacks and the Future of Software Delivery
29mSupply Chain Security: Threats, Defenses And What You Can Do
39mOpen Source Software Supply Chain Security — Why does it matter?
30mSupply Chain Security for OpenSource Projects
15mSoftware Supply Chain Security for those in a rush
41mManaging the Risk of Software Supply Chain Attacks
49mMitigate Risks In Code: Protect Your Software based Supply Chain