SupplyChainSecurityCon @ Open Source Summit Japan 2023
2023-12-05..2023-12-06
-- online --
[SupplyChainSecurityCon @ Open Source Summit Europe 2023, SupplyChainSecurityCon at Open Source Summit Europe 2022, SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon @ Open Source Summit Europe 2024, SupplyChainSecurityCon @ Open Source Summit North America 2024, Critical Software Summit @ Open Source Summit Japan 2022]
as the organisers put it
サイバーセキュリティ インシデントは、今日組織が直面している最大の脅威の 1 つです。OpenSSFおよびCNCFとのパートナーシップの下で開催されるこのイベントには、ソフトウェア サプライチェーンのセキュリティに関心を持つセキュリティ専門家、オープンソース開発者、その他の人々が集まり、ソフトウェア サプライチェーンに影響を与えるセキュリティ上の脅威を調査し、ベストプラクティスと軽減策を共有し、
who it's for
security engineers, devops engineers, platform engineers, open source maintainers, release engineers, compliance engineers
topics
SBOM automation and enrichment; CycloneDX and SPDX interoperability; SBOM generation with Syft and Grype; Tekton chains build pipelines; signed provenance and attestation (in-toto, Sigstore); GUAC knowledge graph and GraphQL API; Trusted Execution Environment provisioning (TEEP, TrustZone, SGX, RISC-V); ORT and SW360 integration; Kaniko container image builds; SLSA adoption and attestation
| title | author | length |
|---|---|---|
| How to Serve Open Source Maintainers Without Annoying Them? | Munawar Hafiz | 37m |
OpenRefactory scans the top 10,000 Java, Python and Go projects with Intelligent Code Repair (iCR) and other static analyzers, manually triages only… | ||
| Beyond Guidelines - Designing & Implementing Robust Build Pipelines | Non Kawana, Keisuke Matsumoto | 41m |
Presents a concrete build pipeline implemented to meet FRSCA and CNCF/NIST guidance, running on Kubernetes with Tekton chains orchestration and CI, source… | ||
| SBOM Automation - Making Compliance Effortless by Consuming, Enrichin... | Kouki Hama, Arun Azhakesan | 39m |
Demonstrates an automated SBOM pipeline that consumes CycloneDX/SPDX SBOMs, enriches them and pushes results into SW360 while using ORT (OSS Review Toolkit)… | ||
| The Evolution of SBOMs in AlmaLinux | Matthias Kruk | 30m |
AlmaLinux has produced per-package SBOM data for over a year by storing build metadata in an immutable build database and using a client SBOM generator that… | ||
| Software Supply Chain Security with Trusted Execution Environment Provisioning (T... | Akira Tsukamoto | 39m |
An open-source TEEP reference implementation and Doxygen docs live on GitHub and run either in Docker + QEMU or on real Intel, ARM TrustZone and RISC‑V boards… | ||
| The Road to Zero CVEs: People and Technology | Andrew Martin, Michael Lieberman | 36m |
Claims that "zero CVEs" is a destination are false; it’s a continuous journey that combines people, process, and tooling. Practical steps shown include signing… | ||
| Eliminating the Unknowns: Using GUAC to Better Understand Your Software Supply... | Michael Lieberman | 37m |
GUac ingests and correlates real SBOMs and attestations (CycloneDX and SPDX SBOMs, in-toto SLSA attestations signed by Sigstore), pulls OSV, VEX, salsa… | ||
| nothing matches | ||