SupplyChainSecurityCon at Open Source Summit Europe 2022
2022-09-13..2022-09-16
-- online --
[SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon @ Open Source Summit Europe 2023, SupplyChainSecurityCon @ OSS NA 2023, SupplyChainSecurityCon @ Open Source Summit Europe 2024, SupplyChainSecurityCon @ Open Source Summit North America 2024, SupplyChainSecurityCon North America 2021]
who it's for
security engineers, open source maintainers, release engineers, package repository operators, devops and delivery engineers, vulnerability researchers, tooling and CI engineers
topics
SBOM verification and attestation; SBOM composition and micro-SBOMs; Sigstore-based artifact signing; SLSA Level 3 release pipelines; The Update Framework (TUF) for repos; PEP 458 and PEP 480 packaging signing; CSAF/VEX interoperability for VEX data; OSS-Fuzz and coverage-guided fuzzing; eBPF runtime component detection; Gitsign keyless git commit signing; SPDX/CycloneDX and provenance tooling
| title | author | length |
|---|---|---|
| From Kubernetes With ♥ Open Tools For Open, Secure Supply Chains | Adolfo García Veytia | 35m |
Kubernetes Release Engineering aims for SLSA Level 3 compliance (targeted around Kubernetes 1.25) and delivers a reusable open toolset: a BOM generator called… | ||
| Improving Package Repository Security – From White Papers to Practice | Jussi Kukkonen | 42m |
Community package repos try to use The Update Framework (TUF) to stop repository-host compromises but run into practical limits: PEP 458 (repository signing)… | ||
| What’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity | Justin Murphy | 45m |
CISA requires machine-readable SBOM data for federal procurement (BOD 22-01 / EO 14028) and treats SBOMs as a transparency layer but says they often produce… | ||
| Trusted-SBOM: On the Critical Importance of Verifying SBOMs | Haoxiang Zhang, Ahmed E. Hassan | 17m |
Defines concrete metrics SBOM correctness (packages declared that appear in the binary) and SBOM completeness (files in the binary whose provenance is traced)… | ||
| Secure Python Packaging & Release Using Continuous Deployment | Martin Vrachev, Jussi Kukkonen | 01h 21m |
Shows a reproducible Python release pipeline that builds wheels with hatchling, computes and compares SHA256 sums, and uploads to test.pypi via Twine using a… | ||
| Composing the Ultimate SBOM | Ivana Atanasova, Velichka Atanasova | 32m |
Argues that post-build scanners miss build and dependency metadata and demonstrates a proof‑of‑concept Micro-SBOMs workflow that generates 205 per-package… | ||
| Making Fuzzing Part of Your Software Development Lifecycle | Jonathan Metzman | 39m |
Explains how coverage-guided fuzzing plus sanitizers finds deep bugs by spending compute not developer time, and how libFuzzer/AFL++ feed harnesses into… | ||
| Zero-Configuration Runtime Software Component Detection | Inhyeok Jang | 20m |
Implements a zero‑configuration runtime detector that uses eBPF kretprobe on read to capture Java process reads, reconstructs zip structures (EOCDR, CDR, local… | ||
| Tracking Attackers in Open Source Supply Chain Attacks: The New Frontier | Tzachi ( Zack) Zorenshtain | 42m |
Shows concrete campaigns and countermeasures: an automated actor RED-LILI (1500 malicious packages) publishes thousands of poisoned packages; a public tracker… | ||
| How to Identify and Avoid Cracks and Bumps in your Digital Infrastructure? By Consi... | Johan Linåker | 40m |
Presents a concrete assessment framework derived from 146 studies that identifies 107 characteristics across 15 themes to measure open source health, and maps… | ||
| Defining the Limits of Risk | Daniel Izquierdo | 25m |
Argues that open‑source projects must be treated as providers and proposes measuring bus factor, average issue resolution time and other community metrics to… | ||
| Because Security Matters: Securing Your Open Sourc... | Michal Svec, Stacey Miller | 41m |
Explains concrete defenses: SUSE locks builds into per-job VMs with the open build service, publishes full provenance at sources.suse.com, signs packages, and… | ||
| BoF: State of SBOM Tools | Nisha Kumar | 42m |
Group documents what SBOM tools actually do, what is missing, and where accuracy breaks down: producers can generate SPDX and CycloneDX SBOMs and projects like… | ||
| Do You Know What's in the Software You Run? Introducing GitBOM | Nell Shamrell-Harrington | 20m |
GitBOM is a minimal build-time scheme that records every input file used to produce each artifact by generating an artifact dependency graph and computing… | ||
| Privacy-preserving Approaches to Transparency Logs | Hayden Blauzvern | 39m |
Explains why Merkle trees, inclusion and consistency proofs, and witness gossiping stop simple deletion: removing leaves or recalculating parents breaks… | ||
| VEXing Open Source Security: Vulnerability Data for Everything | Andrew Martin, Andres Vega | 45m |
VEX is a machine-readable Vulnerability Exploitability eXchange that maps specific CVEs to specific package versions and runtime context, includes metadata… | ||
| Gitsign – Keyless Git Commit Signing | Billy Lynch | 37m |
Gitsign brings keyless signing to Git by generating ephemeral key pairs, exchanging an OIDC token with Fulcio to obtain short-lived certs (10 minute lifetime)… | ||
| Attesting Practically: Exploring the Glue Behind Secure Runtime Environments | Jim Bugwadia | 40m |
Demo shows an OCI image getting a signed attestation pushed with cosign keyless signing via OIDC, provenance and a Trivy JSON predicate attached as an in-toto… | ||
| Sponsored BoF: Baking a Cake with Supply Chain Tooling | Jeffrey Sica | 40m |
A working demo builds a Docker image with GitHub Actions + cosign, generates SLSA provenance JSON, attaches that attestation to Rekor, and uses a kyverno… | ||
| Lightning Talk: Scoring Dependencies to Detect “Weak Links” in your Open-source So... | Ashish Bijlani | 10m |
An open‑source tool called PACKJ scores packages by checking specific risky attributes (abandoned maintainer, expired author email, missing public repo… | ||
| Sponsored Session: Dependencies: Do's and Don'ts | Guy Bar Gil, Rhys Arkins | 42m |
A practical framework called the dependency management sandwich breaks dependency work into visibility (including Docker images, infra, internal code)… | ||
| nothing matches | ||