Reflections on Trust in the Software Supply Chain
summary
Survey of current defenses (SLSA, SBOM/CycloneDX 1.5, code signing) shows gaps: build plugins and extensions can inject payloads during CI/CD. Demo uses a multimodule Maven/Gradle chain and a published artifact to produce a reverse shell from a compromised build helper, illustrating how SolarWinds‑style compromise reaches thousands (SolarWinds affected ~18,000). Proposal shows binary-source validation comparing models from source and artifact, plus a manufacturing SBOM and applying SLSA recursively as mitigations.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:45Supply chain security gap
- 2:51Development toolchain threats
- 7:29Build-time dependencies matter
- 12:23Controls for build-time dependencies
- 15:54Trusting trust problem
- 17:23Demo: malicious build-time dependency
- 24:49Insider threats in open source
- 25:12Mitigations and SALSA
- 27:21Reproducible builds limits
- 28:47Vulnerable vs malicious attacks
- 29:09Binary-source validation
- 34:27Immediate actions for consumers
- 36:16Summary and call to action
related talks
29mState of the secure software supply chain
12mAs Strong As the Weakest Link: Securing the Software Supply Chain
36mBuilding a Trusted and Resilient Software Supply Chain
57mThe Secure Software Supply Chain
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
54mSupply Chain Security for OpenSource Projects
41mHow to protect your software project from supply chain security threats
30mSupply Chain Security for OpenSource Projects