Keynote: Improving OSS Security Through Collaboration
summary
Microsoft describes concrete tools and standards: GitHub Dependabot auto-generates PRs to update vulnerable dependencies; Copacetic (CNCF Sandbox) uses Trivy to scan images, creates a patch layer to update OCI images and is rolling into every Microsoft container build pipeline and used externally; a six‑pillar Secure Future initiative guides work; a vendor‑agnostic S2C2F consumption framework merges with Salsa for produce/consume workflows; and SCITT (IETF) provides a counter‑signed, durable‑log SBOM model with graph consumption via GUAC; an open source SCITT implementation is in progress.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:04Secure Future Initiative overview
- 2:10Protecting engineering systems
- 3:35GitHub Dependabot and Copacetic
- 5:39OpenSSF mission
- 7:05Supply chain risks and OSSF projects
- 8:12S2C2F framework for OSS
- 10:22SKIT project for transparency
- 12:49SKIT implementation and steps
- 14:34Call to action
related talks
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
12mKeynote: A Vision for a Secure Software Supply Chain
11mKeynote: Securing Open Source
04mKeynote: A Secure Supply Chain Vision
08mKeynote: Security of the Open Source Supply Chain, a Call to Action
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
16mKeynote: Security in the Open - How Industry and Community Ben...