Improving the Software Supply Chain Security
summary
Panel lists concrete progress and gaps: GUAC ingesting SBOMs, dep.dev and OSV with GraphQL/REST APIs now used by Google and Microsoft; Sigstore shows broad adoption and Sigstore integrated with GitHub Actions for easy signing; SLSA has a 1.0 baseline, a 1.1 clarifying release queued and a draft SLSA Source Track addressing authoring/process attestations; the biggest missing piece is artifact dependency graphs (Nix/Bazel/omnivore work) to cut noisy CVE impact analysis and a public funding window of up to $1.7M for startups.
AI-written summary · about
chapters (10)
- 0:00Software supply chain security intro
- 3:15Open source security target
- 10:06Industry efforts
- 13:00Progress in supply chain security
- 16:56Key security tools
- 23:21Dependency graph challenges
- 31:12Gaps in supply chain security
- 36:54Supporting open source maintainers
- 40:27Platforms for secure open source
- 43:20Closing remarks & Q&A
related talks
44mPanel Discussion: Improving the Software Supply Chain Security
14mKeynote: The Next Steps in Software Supply Chain Security
11mOSS Supply Chain Security
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
40mImproving Supply Chain Integrity with Ope...
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
36mSecure your software supply chain from dependencies to deployment