Chain Reaction: Remixing CNCF’s Supply Chain Security Guide for 2025
summary
CNCF’s updated Supply Chain Best Practices (v2) lays out concrete changes: industry adoption of SBOMs and attestations, a growing toolset (in-toto, TUF, SLSA, Sigstore, Guac, bomctl, SBOMit, protobom), and a reference implementation Fresca. Supply chain losses hit $45B in 2023 with projections to $80B by 2026; identity mentions jump tenfold and VEX references rise from 0 to 20. Real incidents include XZ Utils backdoor, GitHub Actions tag hijack, and a ghc.io credential trap; author list shrinks from ~40–50 to ~10.
AI-written summary · about
chapters (10)
- 0:00CNCF supply chain security intro
- 3:17Four principles of supply chain security
- 7:08From white paper to SSDF and NIST
- 10:18Recent supply chain attacks
- 13:55Industry response and tooling 2024
- 16:23New terms in 2024 guide
- 21:23Guide structure by persona
- 24:14Current challenges and future state
- 26:45CNCF tag reboot and community
- 29:12Q&A on guide and CRA
related talks
49mMitigate Risks In Code: Protect Your Software based Supply Chain
15mSupply chain security for dummies
19mKeynote: Supply Chain Security in 2024
14mKeynote: The Next Steps in Software Supply Chain Security
39mSoftware Supply Chain Security
40mPractical guides for enhacing your Software Supply Chain Security
12mKeynote: A Vision for a Secure Software Supply Chain
35mUsing CNCF Best Practices for Software Supply Chain to Guide and Enha...