SupplyChainSecurityCon @ OSS NA 2023
2023-05-10..2023-05-12
Vancouver, Canada
[SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon at Open Source Summit Europe 2022, SupplyChainSecurityCon @ Open Source Summit Europe 2023, SupplyChainSecurityCon @ Open Source Summit North America 2024, SupplyChainSecurityCon @ Open Source Summit Europe 2024, SupplyChainSecurityCon North America 2021]
who it's for
open source maintainers, security engineers, package registry operators, ci/cd engineers, devops engineers, release managers, software architects
topics
SBOM generation and analysis; provenance with in-toto attestations; Sigstore Fulcio and Rekor signing; SLSA conformance levels and auditing; reproducible build root causes; LLVM IR binary function fingerprinting; machine-readable advisories VEX and CSAF; container supply chain security; securing Kubernetes manifests with Cosign; Merkle artifact dependency graphs; automated GitHub org configuration (autodog); runtime observability with eBPF and Tetragon
| title | author | length |
|---|---|---|
| Securing Kubernetes Manifests with Sigstore Cosign, What Are Your Options? | Mathieu Benoit | 23m |
Three concrete options for verifying Kubernetes manifests signed with Sigstore Cosign: a kubectl plugin that packages a YAML as an OCI image, signs it with a… | ||
| The Importance of Developer Tooling to Make Open Source More Secure by Default | Brian Behlendorf | 43m |
Scan of real ecosystems finds 61,000 projects flagged for a decades-old Python archive bug and automated fixes get merged in only ~2–3k repositories… | ||
| The Impact of Media on Cybersecurity: Using Art to Visualize Software Supply Chain Security Trends & Increase Awareness of Popular Library Vulnerabilities | Anova Hou | 32m |
Shows that media attention correlates with faster enterprise fixes by comparing coverage-driven remediation rates: scraped Sonatype 2022 trend data turned into… | ||
| OmniBOR: Bringing the Receipts for Supply Chain Security | Ed Warnicke, Aeva Black | 41m |
OmniBOR (Omnivore) captures a build’s exact artifact dependency graph by having build tools embed input-manifest IDs (git object hashes) into outputs, turning… | ||
| Demystifying Unreproducible Builds: What, Why, and How? | Rahul Rajesh Bajaj | 23m |
Analysis of 18 million builds from Debian finds 16 root causes (vs prior 6) grouped into build, filesystem, memory, system. The study shows build path is the… | ||
| Bringing Provenance to All of Open Source: Lessons from Npm’s Sigstore Integration | Trevor Rosen, Zach Steindler | 27m |
npm ties a package back to exact commits and build instructions for the registry that serves 70 billion packages per month by adding a flag npm publish… | ||
| Security Advisory Programs: Creating Transparency Along the Software Supply Chain | Tyler Townes | 39m |
Security advisory program explains concrete practices: public coordinated disclosure policy, a templated advisory workflow with templates with gray and yellow… | ||
| Code Genome - Fingerprinting Code to Build Trustworthy SBOMs | Ian Molloy, Jiyong Jang | 57m |
Project fingerprints functions by lifting binaries to LLVM IR canonicalization and producing semantically meaningful embeddings, then links those embeddings… | ||
| Panel Discussion: Open Source Supply Chain Security - Are Containers.. | Liz Rice, Ayse Kaya, Lisa-Marie Namphy, Josh Bressers | 40m |
Claims that containers are the biggest blind spot get grounded in numbers and tools: the panel cites scanned 3 million containers and npm scale of 2.3M… | ||
| SLSA Conformance | Kris Kooi | 31m |
SLSA 1.0 defines build levels 1–3 with concrete producer and build-platform requirements: producers must pick a compatible builder, keep a consistent process… | ||
| Is SBOM for the Cloud Even a Thing? | Nisha Kumar | 53m |
SBOMs for networked cloud services prove limited because services are not distributed products; a list of packages rarely tells whether an API path is… | ||
| Panel Discussion: Ketchup, Mustard, and Relish of Software Supply Chain Security | Arnaud J Le Hors, Jay White, Michael Lieberman, Melba Lopez | 46m |
OpenSSF Supply Chain Integrity work focuses on concrete deliverables: Salsa 1.0: five build requirements (provenance, isolation, strength) after cutting ~20… | ||
| Configuration as a Code: Managing Hundreds of GitHub Organizations to Streamline Supply Chain Security | Mikaël Barbero | 37m |
Eclipse Foundation builds and runs autodog, a Python3 command-line system that snapshots and enforces GitHub org and repo settings across roughly 150… | ||
| Realities of SBOM: What Is Under the Hood of SBOM? | Hasan Yasar | 50m |
SBOMs are not static files but a dynamic, per-build artifact tracked across code, build and runtime phases; the demo shows cargo generating CycloneDX/SPDX… | ||
| Improving the Security of a Large Open Source Project One Step at a Time | Michael Dawson, Paula Paul | 47m |
Node.js security working group secures core with OpenSSF funding, uses HackerOne for private reports, a private repo for fixes, and an eight‑to‑nine‑person… | ||
| An SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s! | Jeff Shapiro, Gary O'Neall | 46m |
Minimum SBOM here is concrete: a 38-line NTIA-conformant file with supplier, component name, version, unique IDs (PackageURL/CPE/CVE), dependency relationships… | ||
| Lightning Talk: Smaug's Cave: Studying Thousands of Gems at Shopify | Jacques Chester | 07m |
Shopify reconstructs historical RubyGem usage by scraping GitHub commits and extracting every Gemfile.lock change into SQLite, then joining that with the Ruby… | ||
| Lightning Talk: Criticality Scores Unveiled: A High Schooler’s Journey with OpenSSF | Nathan Naveen | 09m |
Uses the Rob Pike algorithm to combine signals (last update, contributor count, commit frequency, closed issues) with per-signal thresholds to produce a… | ||
| Lightning Talk: Enabling “Safe” Use of Untrusted Open Source Dependencies with Sandboxing | Ashish Bijlani | 09m |
Claims a novel tool, Packj sandbox, blocks install-time malware by creating an isolated filesystem layer and network firewall while remaining compatible with… | ||
| Software Supply Chain Security Case Study at Anaconda | Sebastien Awwad | 43m |
Anaconda implements end-to-end content trust for its curated package build pipeline: packages are built and metadata is signed at build time, verification… | ||
| Toto-Ally TUF: Simple Tools for a Secure Software Supply Chain | Marina Moore, Aditya Sirish A Yelgundhalli | 35m |
Software supply chain compromises rise 742% over three years and the claim is that combining TUF and in-toto gives verifiable end-to-end integrity. The demo… | ||
| What the &#% Is in That SBOM? How to Provide Users What Software Components Are Included | Helio Chissini de Castro | 38m |
SBOMs are a final contract of upstream data, not a silver-bullet product: ingest and standardize with Package-URL (PURL) so components map reliably to a… | ||
| Verifying the Validity of Crowd-Sourced Results in the Open Source Community: The Scorecard GitHub Action and Sigstore | Naveen Srinivasan, Spencer Schrock | 32m |
The Scorecard GitHub Action produces crowd-sourced security results for ~1,000,000 repositories per week and signs each result with Sigstore tooling: cosign… | ||
| Never Break the Chain: Securing the Container Supply Chain with Notary, TUF, and Gatekeeper | Katie Novotny, Diego Casati | 27m |
Demo builds container images directly into Azure Container Registry, signs them with Notation/Notary (TUF) using keys stored in Azure Key Vault, and verifies… | ||
| Patterns That Protect: Securing Workloads in Automated Deployments | Kerim Satirli | 38m |
Shows concrete, working patterns: uses Terraform to codify GitHub allow lists and GitHub Actions with content-addressed allowlist entries (no human tags)… | ||
| Where Is the GUAC? | Parth Patel, Mihai Maruseac | 40m |
GUAC ingests SBOMs and attestations (SPDX, CycloneDX, SALSA) from local folders or OCI into a knowledge graph and exposes it via GraphQL query layer and… | ||
| SLSA with Us: The Dance of AppSec | Michael Lieberman | 40m |
SLSA Build 1.0 enforces provenance for source-to-artifact builds and defines three levels: L1 exists provenance, L2 signed provenance, L3 unforgeable per-build… | ||
| nothing matches | ||