SupplyChainSecurityCon at Open Source Summit North America 2022
2022-06-21..2022-06-24
-- online --
[SupplyChainSecurityCon at Open Source Summit Europe 2022, SupplyChainSecurityCon @ Open Source Summit Europe 2023, SupplyChainSecurityCon @ Open Source Summit North America 2024, SupplyChainSecurityCon @ OSS NA 2023, SupplyChainSecurityCon @ Open Source Summit Europe 2024, SupplyChainSecurityCon North America 2021]
as the organisers put it
Cybersecurity incidents are among the greatest threats facing organizations today. This event gathers security practitioners, open source developers, and others interested in software supply chain…
who it's for
security practitioners, open source developers, devops engineers, platform engineers, site reliability engineers, software architects, compliance auditors
topics
OpenSSF Scorecard scanning; GitHub Actions security hardening; SLSA provenance and attestation; sigstore OIDC keyless signing; SBOM aggregation and management; reproducible builds and provenance; git OIDs as artifact identifiers (gitbom); static analysis for dependency tools; package registry security roles; automated SLSA compliance evaluation; container threat mapping with MITRE ATT&CK
| title | author | length |
|---|---|---|
| Assessing the Risk of Open-source Components Using OpenSSF's Scorecard | Laurent Simon, Naveen Srinivasan | 42m |
OpenSSF Scorecard is an open-source scanner with a CLI and GitHub Action that runs ~1 million repositories weekly and publishes results to BigQuery; it… | ||
| Authenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub | Asra Ali, Laurent Simon | 39m |
Demonstrates a practical pipeline for non‑forgeable remote code attestations on GitHub using reusable workflows for isolation and sigstore OIDC keyless signing… | ||
| Dear Security, Compliance, and Auditors, We’re Sorry. Love, DevOps. | Bill Bensing | 43m |
Argument: governance is the current delivery bottleneck and must be turned into autonomous governance where machines execute policy while humans codify it… | ||
| GitBOM: Repurposing Git’s Graph for Supply Chain Security & Transparency | Aeva Black, Ed Warnicke | 43m |
Proposal repurposes Git object ids to use git OIDs as canonical artifact IDs and defines a tiny file format where each build emits a gitbom document that… | ||
| Github Actions Security Landscape | Alex Ilgayev, Ronen Slavin | 36m |
Research finds widespread misuses that let untrusted issue titles execute shell on runners and steal tokens. Using ngrok + netcat the exploit opens a reverse… | ||
| Going Beyond Metadata: Why We Need to Think of Adopting Static Analysis in Dependency Tools | Joseph Hejderup | 41m |
Argues that metadata-only dependency tools produce many false positives for transitive libraries and that lightweight static analysis — especially call graphs… | ||
| Google SLSA & NIST SSDF: Emerging Software Supply Chain Security Best Practices | Tony Loehr | 29m |
Compares NIST SSDF v1.1 (what minimum security controls to require) with SLSA levels 0–4 (how to score and harden build systems), recommends concrete steps… | ||
| How Do We Rank Project Risk? | Jacques Chester | 41m |
Proposal: rank open source projects by expected dollar exposure computed from separately elicited event frequency and event magnitude estimates, multiply their… | ||
| Kubernetes Risk Assessment: Time to Go One Level Deeper | Ariel Shuper | 26m |
Argues that the CIS Benchmark is a solid, automatable baseline but insufficient alone, and that the MITRE ATT&CK for Containers adds more than 40 validated… | ||
| Lessons Learned from Automating SLSA-Compliance Evaluation | Daniel Nebenzahl | 42m |
Automated evaluation of SLSA across Jenkins/Kubernetes and GitHub Actions collects logs and API data to produce minimal provenance (typically Builder ID and… | ||
| Lightning Talk: Automatically Restrict Permissions for the GITHUB Token | Varun Sharma | 08m |
A January 2021 incident shows a command injection in a VS Code workflow exfiltrating the ephemeral GitHub Actions token which had contents write permission… | ||
| Managing Application Level SBOMs with Ortelius | Tracy Ragan | 41m |
Ortelius is a microservice catalog that collects component-level SBOMs, CVE data and deployment metadata and aggregates SBOMs up to application level so teams… | ||
| Maslow's Hierarchy of Supply Chain Needs | Josh Bressers | 32m |
Maslow-style hierarchy frames supply chain security with SBOM as foundation and concrete layers: Anchore tools SIFT and Grype produce SBOMs and scans, feeding… | ||
| Panel Discussion: How the Business Community is Working to Make the Open Source Software Supply... | Jory Burson, Rao Lakkakula, Andrew Aitken, Jeffrey Borek | 42m |
Large enterprises describe concrete moves: a bank reports ~50,000 developers and an internal repo with ~500,000 open source packages, organizations find… | ||
| Panel Discussion: Summing Up the Summit: OpenSSF’s May 2022 Gathering and Action Plan | Trey Herr, Amelie Koran, Brian Behlendorf, David Wheeler | 44m |
Summary of the OpenSSF May 2022 mobilization plan presenting concrete targets: ten work streams with immediate next steps, tool pilots (notably Sigstore and… | ||
| Purl and Vers: The Mostly Universal Package URL & Version Ranges Identifiers for Dependencies &... | Philippe Ombredanne, Hritik Vijay | 24m |
Proposes PURL for exact cross-ecosystem package IDs and VERS for a minimal, ecosystem-aware version-range syntax that maps comparators (>, >=, etc.) into each… | ||
| Reproducible Builds: Unexpected Benefits and Problems | Bernhard M. Wiedemann | 40m |
Over 1000 reproducibility patches lead to concrete fixes: eliminate timestamps and hostnames, sort directory listings to avoid ext4 hash randomness, fix racey… | ||
| Road to SLSA3: Non-falsifiable Provenance in Tekton with SPIFFE/SPIRE | Parth Patel, Brandon Lum | 38m |
Build pipeline Tekton integrates SPIFFE/SPIRE and Tekton Chains to reach SLSA level 3 by making provenance non-falsifiable: each taskrun pod receives an SVID… | ||
| SBOM Ingestion and Analysis at New York-Presbyterian Hospital | Katie Bratman, Adam Kojak | 40m |
An open source web app called Daggerboard ingests CycloneDX and SPDX SBOMs, cleans inconsistent package names, builds CPEs from package name+version, and… | ||
| Sponsored Session: Because Security Matters: Securing Your Open Source Supply Chain | Aaron Conklin, Don Vosburg | 45m |
Claims a reproducible, multi-architecture build pipeline using Open Build Service (OBS) that compiles, tests and signs binaries, publishes verification… | ||
| Sponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack | Jossef Harush Kadouri | 37m |
Demonstrates concrete attacks: a malicious pip/npm package exfiltrates SSH keys and environment variables after a simple install, and GitHub Actions pipelines… | ||
| Sponsored Session: Malicious Package Trends Compared With Malware Evolution | Daniel Elkabes | 46m |
Claim: registries see about 22 malicious packages daily (≈2% of npm uploads); first wave in 2017 was 37 packages. Common attack vectors are typo‑squatting… | ||
| Sponsored Session: Software Supply Chain Threat Landscapes: A Moving Target | Brian Fox | 41m |
Open source consumption hits billions of downloads (Maven Central ~600 billion) and attackers move from exploiting old CVEs to typosquatting and attacking dev… | ||
| What Makes A Build Reproducible? | Rose Judge, Joshua Lock | 45m |
Defines three concrete levels: repeatable (scripted build steps), rebuildable builds (internal mirrors and cached intermediates produce equivalent artifacts… | ||
| What Role Do Package Registries Have in Securing the Supply Chain? | Justin Colannino, Margaret Tucker | 41m |
GitHub proposes five draft principles that push registries to build concrete tooling and processes: prioritize trust-first registries, map exact roles for… | ||
| nothing matches | ||