Panel Discussion: Improving the Software Supply Chain Security
summary
Panelists describe concrete progress: GUAC ingesting SBOMs and exposing GraphQL/REST APIs today to answer whether a CVE impacts one or 100 apps; sigstore for easy signing shows real adoption integrated into GitHub Actions and npm; a salsa source track draft aims to attest how source was produced but remains in draft and won’t solve identity problems. Biggest gaps are adoption, brittle dependency graphs, and maintainer funding — tools exist and partially work, but scale and default secure platforms do not yet.
AI-written summary · about
chapters (10)
- 0:00Software supply chain security intro
- 3:15Open source security target
- 10:06Industry efforts
- 13:00Progress in supply chain security
- 16:56Key security tools
- 23:21Dependency graph challenges
- 31:12Gaps in supply chain security
- 36:54Supporting open source maintainers
- 40:27Platforms for secure open source
- 43:20Closing remarks & Q&A
related talks
44mImproving the Software Supply Chain Security
50mRunning in the Shadow: Perspectives on Securing the Software Supply Chain
12mKeynote: A Vision for a Secure Software Supply Chain
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
40mPanel Discussion: Open Source Supply Chain Security - Are Containers..
14mKeynote: The Next Steps in Software Supply Chain Security
37mSupply Chain Attacks and the Future of Software Delivery
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue