SupplyChainSecurityCon @ Open Source Summit Europe 2024
2024-09-16..2024-09-18
Vienna, Austria
[SupplyChainSecurityCon @ Open Source Summit Europe 2023, SupplyChainSecurityCon @ Open Source Summit Europe 2024]
[SupplyChainSecurityCon at Open Source Summit Europe 2022, SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon @ OSS NA 2023, SupplyChainSecurityCon @ Open Source Summit North America 2024, Open Source SecurityCon Europe 2026, SupplyChainSecurityCon @ Open Source Summit Japan 2023]
who it's for
security engineers, open source maintainers, devops engineers, platform engineers, software supply chain engineers, engineering managers
topics
static analysis at scale; callpath analysis for Go; GitHub build provenance API; SLSA attestations and signing; Sigstore and cosign ephemeral signing; repository configuration as code; malicious VS Code extension risks; dependency extraction with Renovate; SBOM VEX CSAF EOL mapping; artifact dependency graphing; open source governance scoring
| title | author | length |
|---|---|---|
| "Here Is a Clean Section of the Beach" - Proactively Auditing Op... | Munawar Hafiz, Michael Winser | 45m |
Alpha-Omega funds a program with OpenRefactory that uses a static analysis engine called ICR to scan at scale: ~1,000 packages/month, ~6,500 PyPI artifacts… | ||
| Policing Open-Source Projects at Scale | Thomas Neidhart | 47m |
Eclipse Foundation implements a config-as-code system that stores each project’s GitHub configuration in an eclipse-fdn repo per org, currently covering 176… | ||
| Capslock: Escaping Bad Dependencies | Jess McClintock | 38m |
Capslock is a CLI that performs callpath-level analysis of Go code, using function-level call graphs to report concrete capabilities (filesystem, network… | ||
| VSCorode: Inside Your IDE, Inside Your Git Repository | Kevin Ward, Fabian Kammel | 46m |
Shows a working malicious VS Code extension that reads the local secrets sqlite and OS keyring (Chromium/Electron flow), stole GitHub token in the demo, and… | ||
| Application Security is a Community Effort | Fernando Diaz | 43m |
Claim: open source accelerates detection and remediation by letting many eyes vet code — transparency exposed the XZ backdoor and sped fixes. GitLab composes… | ||
| Planning for Retirement: How Can We Prepare for Software’s... | Victoria Ontiveros, Justin Murphy | 41m |
Proposes a concrete definition of support as a reasonable expectation of a predictable, effective response to a new security risk, maps EOL/EOS metadata into… | ||
| Improving the Software Supply Chain Security | Tom Hennen, Michael Lieberman | 44m |
Panel lists concrete progress and gaps: GUAC ingesting SBOMs, dep.dev and OSV with GraphQL/REST APIs now used by Google and Microsoft; Sigstore shows broad… | ||
| Measuring Security Risk: Community Engagement Is the Best Mitigation | Deb Nicholson | 30m |
Open source risk becomes manageable by concrete steps not handwavy metrics: join mailing lists, monitor GitHub activity, follow beta releases, and look for… | ||
| Enhancing Artifact Security with GitHub’s Build Provenance... | Fredrik Skogman, Radoslav Dimitrov | 46m |
Demonstrates using GitHub’s Build Provenance API to emit SLSA attestations and Sigstore-backed signatures (Fulcio issues 10-minute certs, cosign-compatible… | ||
| Back to Security Basics: Evaluating, Consuming, and Contributing Open Source... | Katherine Druckman | 41m |
Open source use is ubiquitous — npm grows from 1 million to 3.6 million releases in three years — and that volume creates risk. Evaluation relies on concrete… | ||
| Extract Dependency Data on Scale with Renovate | Sebastian Poxhofer | 50m |
Renovate is used to extract dependency data across repositories by running managers (100+ supported) and emitting concise JSON reports or pushing them to S3… | ||
| nothing matches | ||