SupplyChainSecurityCon @ Open Source Summit North America 2024
2024-04-16..2024-04-18
Seattle, United States
[SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon @ Open Source Summit Europe 2023, SupplyChainSecurityCon at Open Source Summit Europe 2022, SupplyChainSecurityCon @ OSS NA 2023, SupplyChainSecurityCon North America 2021, SupplyChainSecurityCon @ Open Source Summit Europe 2024]
who it's for
supply chain security engineers, security engineers, platform engineers, software engineers, open source maintainers, engineering managers, site reliability engineers
topics
hardware-attested SLSA requirements; TPM PCR quoting and event logs; Merkle tree runtime verification; SBOMs for SaaS services; Guac graph API for provenance; in-toto with OPA Gatekeeper; dependency resolution behavior; automated open source intake; Scorecard structured probe JSON; securing git with Gittuf; large language model supply chain controls; end-of-life EOS/EOL machine-readable metadata
| title | author | length |
|---|---|---|
| When to Send Flowers? End of Life and End of Support Across the Ecosystem | Allan Friedman | 48m |
Argues for separate data from policy by publishing time-varying EOL/EOS metadata (who, what, when) as machine-readable JSON linked to SBOMs but managed via… | ||
| TPMs, Merkle Trees and TEEs: Enhancing SLSA with Hardware-Assisted... | Marcela Melara, Chad Kimes | 41m |
Proposes adding hardware-attested build-environment requirements to SLSA so CI platforms publish and validate VM image provenance using TPM PCR quoting plus an… | ||
| The Chronic Disease Plaguing the Internet | Robin Bender Ginn | 25m |
Research finds about 3/4 billion websites are out of date and roughly one third of surveyed organizations report a security incident in the last 24 months… | ||
| Structured Scorecard Results: Tailor Your Own Supply-Chain... | Adam Korczynski, David Korczynski | 35m |
OpenSSF Scorecard now exposes its underlying heuristics as Scorecard Structured Results so users can call individual probes (50+ heuristics) instead of relying… | ||
| Benefits of Automated Open-Source Intake Management | Stan Wisseman | 42m |
Forrester study of 300+ respondents reports 27% of teams catch OSS issues at intake, 41% only after ingestion, 28% during testing and 4% in production, and… | ||
| Securing Git Repositories with Gittuf | Aditya Sirish A Yelgundhalli, Billy Lynch | 38m |
Gittuf embeds signed policy metadata inside Git refs so repositories carry verifiable rules and a reference state log that records every ref update, signed and… | ||
| SBOM in SaaS Environments: An Update | Nisha Kumar | 44m |
CISA spins up a year-long CISA workstream in April 2023 with three subgroups and publishes a white paper defining how SBOMs apply to SaaS; the group finds… | ||
| Picking a Winner: How to Pick the Right Dependency (Resolution... | Eve Martin-Jones, Josie Anugerah | 48m |
Dependency resolution produces wildly different outcomes: D3 can yield about 10^81 possible graphs even though it lists only 30 direct deps and 2.3 million… | ||
| Improving Supply Chain Integrity with Ope... | Arnaud J Le Hors, Jay White, Michael Lieberman, Marcela Melara, Isaac Hepworth | 40m |
OpenSSF technologies target concrete gaps: Salsa v1 defines three incremental build-integrity levels plus a provenance document and is expanding to protect… | ||
| 6 Months In: (Building and) Using the OpenSSF Se... | Sarah Evans, CRob, John Kjell | 36m |
Six months of work produces a concrete model: a catalog of nine security capabilities from creation to retirement, mapped to real tools (Salsa for Salsa builds… | ||
| OSS Supply Chain Threats and Why You Need a Holistic Security Strategy | Adrian Diglio | 51m |
Open source dependencies show 98% prevalence and Microsoft finds 83,000 unique packages used 11 million times; attacks doubled in 2023 and exploit published… | ||
| Logically Securing the Illogically Logical Use of Large Language Models | Sarah Evans, Jay White | 43m |
Scenario: someone downloads a model from Hugging Face and runs it on internal data; scanning reveals instances where models carry a malware backdoor found and… | ||
| Quantifying Nebraska | Adam Harvey | 12m |
Uses cargo.lock to extract repo URLs via the crates.io API and finds 494 Rust dependencies plus 1,999 JavaScript dependencies, then scores repos by measurable… | ||
| Elephant in the Room: How Supply Chain Security Standards Are Not St... | Kyle Quest | 11m |
Claims that SBOM formats are not true standards and the core interoperability break is package identity, not just competing formats. Evidence: CycloneDX… | ||
| Charting the Course for Secure Software Supply Chain with Guac-AI-Mole! | Ridwan Hoq | 10m |
A prototype called Guac-AI-mole converts plain-English queries into GraphQL against GUAC, pulls SBOMs from OCI registries using OCI refer/oras, and correlates… | ||
| A Teen’s Perspective on Navigating Open Source Security with GUAC | Nathan Naveen | 07m |
GUAC builds a dependency graph by ingests SBOMs, then ranks packages by calculating dependents and by OpenSSF Scorecard values; it produces a combined 0–1 risk… | ||
| Fresh SLSA and GUAC Starts with Knowing Your Ingredients | Michael Lieberman, Melissa McKay | 40m |
Open source dependency graphs explode quickly: a small Java microservice demo pulls 114 direct and transitive components; Log4j hit ~70,000 projects directly… | ||
| Dependency Management: The Cause of—and Solution to—All Supply... | Josie Anugerah, Eve Martin-Jones | 40m |
Dependency graphs contain hundreds to thousands of transitive packages and change rapidly: depths.dev finds up to 25% daily graph churn in npm and PyPI, and… | ||
| A Step Closer to in-Toto’lly Secure: Using in-Toto and OPA Gatekeeper... | Tom Meadows, John Kjell | 45m |
Demonstrates an end-to-end pipeline that generates signed attestations for each CI step with in-toto tooling, captures commands via Witness, stores and indexes… | ||
| nothing matches | ||