Sponsored Session: Because Security Matters: Securing Your Open Source Supply Chain
summary
Claims a reproducible, multi-architecture build pipeline using Open Build Service (OBS) that compiles, tests and signs binaries, publishes verification metadata, and enforces EAL4+ certification plus NIAP, DISA STIG, FIPS 140-3 and CIS benchmarks. Describes Uyuni and SUSE Manager (Salt minions) for staged content lifecycle, cross-distro patching and long (10+ year) support, reports customer savings (Office Depot) from automated patching, and says continuous review and signing keys maintain non‑repudiation.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:03History of Supply Chain Attacks
- 1:47Supply Chain Attacks Are Increasing
- 2:39A Secure Software Supply Chain
- 4:32What Is Security about
- 9:04How Do You Find the Right Mix
- 10:37Common Criteria Certificate
- 14:56Global Reach
- 17:00Disa Stig Frameworks
- 17:54National Institute of Standards and Technology
- 21:25Plan the Build
- 34:40Why Fix It
- 40:49Content Lifecycle Management
related talks
41mBecause Security Matters: Securing Your Open Sourc...
30mSupply Chain Security for OpenSource Projects
37mSecuring OSS across the whole supply chain and beyond
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
30mSecuring Open Source Supply Chains
43mBuilding Trust Through Proactive Security - Key Parts of the Trus...
23mMastering Secure Software Supply Chains
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...