The State of Supply Chain Security in the Cloud Foundry Ecosystem
summary
Cloud Foundry already has Bosh reproducible builds and a concrete risk model (compromised repos, build servers, or artifact stores) illustrated by SolarWinds–style attacks and malicious gems. The proposal is to generate SBOMs for Bosh releases, aggregate them per-release, and reproduce artifacts via provenance. Practical next steps: build cf-cli and related CLIs on GitHub Actions using the Salsa level 3 Go builder, migrate Concourse tasks toward Concourse hermetic builds, and aim for SLSA v2/v3 provenance and signed attestations.
AI-written summary · about
chapters (7)
- 0:00Introduction to supply chain security
- 1:05What are SBOMs and why they matter
- 8:15Supply chain attack vectors explained
- 12:34SLSA guidelines and attestations
- 17:28Current Cloud Foundry supply chain efforts
- 19:34Next steps for Cloud Foundry security
- 24:44Q&A on signing and distribution
related talks
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
30mSupply Chain Security for OpenSource Projects
35mRunning Cloud Foundry in a Compliance and Security Focused Environment
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
23mSupply Chain Security using Free and Open Tools
30mSecuring Open Source Supply Chains
34mUntrusted Execution: Attacking the Cloud Native Supply Chain - Francesco Beltramini
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue