Conan.Io – Lessons Learned from Securing 40,000 C++ Packages
summary
Conan Center claims 0 security incidents while serving ~1 million downloads and ~25 TB/month, storing 1.4 million binary packages (20 TB) built from 1,400 recipes; CI uses Jenkins agents, Artifactory repos and a Google CDN, Windows/mac builders get periodic rebuilds via Ansible, and uploads live behind GitHub PR gating. Contribution flow enforces an allowlist, automated diffs and binary checks, ephemeral build repos, package signing plugin and a manual two-review gate, with 100 recipes covering 80% of downloads.
AI-written summary · about
chapters (9)
- 0:00Conan introduction
- 2:29Conan Center infrastructure
- 7:12Security challenges
- 12:50Manual review process
- 16:02Secure Conan usage
- 19:34Security improvements
- 23:05Scaling reviews
- 26:56Future security plans
- 29:02Q&A
related talks
06mLightning Talk: DevSecOps for C++? Keep Calm and use Conan
24mSecurity as Code A SecDevOps Use Case
33mWhat is the secure software supply chain
49mTrustworthy Open Source: The Consequences of Success
35mKeynote: How I learned to stop worrying and love CVEs
17mBuilding Secure Open Source Communities From the Ground Up
13mKeynote: Hacking the OSS Supply Chain
24mPeter, the May and the Must, and Lacework