Securing the Open Source Software Supply Chain
summary
Asserts open source is usable but needs concrete controls and shows real tools, not just theory: use pip audit to find and auto-fix known vulnerabilities, adopt six store signing with ephemeral keys and a public transparency log, require attestations and SLSA level checks via salsa for build integrity, and expect operational changes like a 4,000 Google Titan key giveaway and upcoming mandatory 2FA for critical PyPI projects — practical measures, who implements them, and whether they stop real attacks.
AI-written summary · about
chapters (37)
- 0:00Intro
- 1:01Q&A
- 1:20Is it safe to use open- source software?
- 1:37Is it safe to use open-source software? Yes!
- 2:15A better question: How can we use open-source software safely?
- 2:31What is the Software Supply Chain?
- 2:46What is the Secure Software Supply Chain?
- 3:22Why is software- supply chain security such a big deal right now?
- 5:51ABCs of the Secure Software Supply Chain
- 8:43Ephemeral
- 9:15Fuzzing
- 11:22Joe Biden
- 12:16Money
- 13:16Open ID Connect
- 13:42Provenance
- 14:22Remediation
- 16:29New! Community advisory databases
- 17:32New! Vulnerability auditing software
- 20:24GPG relies on a web of trust
- 20:47A new standard for signing, verifying and protecting software
- 21:00Understanding sigstore Throw away your keys
- 21:17Understanding sigstore Provide an identity
- 21:34Understanding sigstore Bind key & identity to signing certificate
- 22:02Understanding sigstore Publish in the transparency log
- 23:16New! Better, more secure build infrastructure
- 23:27Safeguarding artifact integrity across any software supply chain
- 23:37Understanding SLSA ( salsa') Security framework • Checklist of standards and controls • A series of levels
- 24:18Understanding in-toto • A universal standard • For all ecosystems • Ensuring integrity of an artifact • Proof of what was done at each step
- 24:31New! Enforcing security policies for source control
- 24:46Understanding Allstar • A GitHub app • Enforces best practices • Allows you to set policy • Across an entire organization
- 25:29Voluntary 2FA requirement
- 25:512FA mandate for critical projects
- 26:14Hardware key giveaway
- 27:07Coming soon! PEP 458 implementation & PEP 480 update
- 27:27Improvement: Vendor neutral collaboration
- 27:50Improvement: More funding for projects
- 28:28Predictions: My predictions for the next year
related talks
30mSecuring Open Source Supply Chains
09mSecuring the Software Supply Chain with Open Source
39mOpen Source Software Supply Chain Security — Why does it matter?
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
11mKeynote: Securing Open Source