SupplyChainSecurityCon @ Open Source Summit Europe 2023
2023-09-19..2023-09-21
Bilbao, Spain
[SupplyChainSecurityCon @ Open Source Summit Europe 2023, SupplyChainSecurityCon @ Open Source Summit Europe 2024]
[SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon at Open Source Summit Europe 2022, SupplyChainSecurityCon @ Open Source Summit North America 2024, SupplyChainSecurityCon @ OSS NA 2023, Open Source SecurityCon Europe 2026, SupplyChainSecurityCon @ Open Source Summit Japan 2023]
as the organisers put it
Cybersecurity incidents are among the greatest threats facing organizations today. This event, held in partnership with OpenSSF and CNCF, gathers security practitioners, open source developers…
who it's for
open source maintainers, security engineers, software supply chain engineers, devops engineers, security researchers, engineering managers, cloud native operators
topics
SBOM generation and consumption; OpenVEX statement composition; SPDX SBOM production; CycloneDX service profile; confidential computing attestation; reproducible builds and provenance; maven JAR dependency resolution; repository hardening with Scorecard; automated SARIF scanning and triage; Wolfi based container SBOMs; SaaSBOM service snapshot; grype scanner VEX support
| title | author | length |
|---|---|---|
| Ketchup, Mustard, and Relish... | Laura Seay, Arnaud J Le Hors, Jay White, Michael Lieberman, Joshua Lock | 40m |
Salsa reaches version 1.0 (April) with a focused build track and three build levels emphasizing provenance generation, attestation, and isolation; Fresca… | ||
| Opening the JAR: The Hitchhiker's Guide to JAR File Dependencies | Daniel Haim Breger | 28m |
Maps how dependencies actually end up inside a JAR: POM.xml entries, maven shade plugin renaming versus assembly/uber-JAR unpacking, and OSGi’s import-package… | ||
| It's All About Trust: Why Confidential Computing Matters | Mike Bursell | 37m |
Confidential computing isolates computation in hardware TEEs so data in use stays encrypted and code integrity is verifiable, with silicon like Intel SGX, AMD… | ||
| Adventures in Securing an Open Source Project: From Repo Security Zero... | Kara Olive, Pedro Nacht | 43m |
A real repository is intentionally sabotaged to a 1.2–1.9/10 Scorecard rating using missing tests, writable workflow tokens, vulnerable dependencies and an… | ||
| Don't Start Over, Start Left: Choosing the Right Open Source... | Martin Hell | 43m |
An SCA-driven evaluation workflow that extracts GitHub metrics and trends identifies risky choices early: a 500,000 lines of code base contains 30,000 LOC tied… | ||
| Your Software Supply Chain is Only as Secure as its Weakest Link | Boris Cipot | 25m |
Argues that transitive open‑source dependencies create hidden attack chains and that simply “throwing tools” at developers fails; recommends SBOM inventorying… | ||
| Security Research with Open Source Software: Vol. Omega | Yesenia Yser | 44m |
Alpha Omega targets 10,000 critical open source projects and aims to end manual disclosure by automating discovery, triage and fixes. It runs the Omega… | ||
| Improving the Security of a Large Open Source Project One Step... | Michael Dawson, Rafael Gonzaga | 48m |
Node.js documents a threat model that narrows what counts as a vulnerability, uses HackerOne to take private reports and issue CVEs, and runs a rotating triage… | ||
| Enabling VEX and Full SBOM Coverage with Wolfi Based Containers | Adolfo García Veytia | 33m |
Wolfi-based images produce complete SPDX SBOMs including file-level hashes and package provenance, Wolfi advisories feed an automated generator called vaccine… | ||
| SEAPATH: A LF Energy Project for Critical Infrastructure with an... | Eloi Bail, Mathieu Dupré | 36m |
SEAPATH virtualizes electrical substations to run multi-vendor VMs and aggregates third‑party OSS into a Debian flavor and a Yocto flavor, with Yocto builds… | ||
| Bringing Service Security to a New Level: An Introduction to SaaSBOMs | Ivana Atanasova, Rose Judge | 36m |
Defines a SaaSBOM as a snapshot linking one service to many SBOMs plus service metadata like service identifier, data flow and classification, geographic… | ||
| Insights from the Cloud Native Security Slam | Eddie Knight | 45m |
CNCF’s Security Slam has 13 projects running CLOMonitor to collect 11 months of Scorecard data, revealing that 163 repositories are tracked via about 8,000 API… | ||
| Dependency Management: The Cause of—and Solution to—All Supply... | Eve Martin-Jones, Josie Anugerah | 38m |
Claims that dependency resolution is NP‑complete, and that Google built deps.dev and reimplemented resolvers (including a 9x9 Sudoku test) to study real… | ||
| The SBOM Way! The Art of Consuming, Enriching, and Managing Inbound.. | Anupam Ghosh, Arun Azhakesan | 42m |
Build delivers a new SW360 package portlet plus a CycloneDX importer and pipeline that sends binary/package data into a clearing flow with FOSSology… | ||
| Will Large-Scale Automated Scanning Stop Malware on OSS Repositories? | Zachary Newman | 41m |
Large-scale automated scanning fails as a primary defense because even a very sensitive detector produces a false positive avalanche against PyPI’s million… | ||
| Scaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once... | Jonathan Leitschuh | 46m |
Finds and fixes concrete patterns at scale using CodeQL to locate vulnerable Java projects and OpenRewrite to make style-preserving AST edits. The workflow… | ||
| nothing matches | ||