How’s Your Supply Chain with Your Insecure OSS Ingestion?
summary
A policy-driven pipeline named CSSI is built on Tekton & Open Policy Agent to ingest OSS, run scorecards, signature checks, Snyk vulnerability scans and sandbox install-script runs, then store provenance via Tekton Chains, DSSE envelopes, S3 and DynamoDB/MongoDB. The demo ingests npm react plus transitive deps, accepts the signed react artifact, quarantines a package with a remote‑code‑execution CVE, and supports continuous grooming to re-evaluate millions of artifacts as policies change.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:13Supply Chain Landscape
- 2:58Package Manager Scripts (The Why)
- 6:43The History
- 8:32Evolution & tooling
- 9:48Solution: Aims
- 10:27Use Cases
- 12:46Flows
related talks
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
23mSupply Chain Security using Free and Open Tools
40mPractical guides for enhacing your Software Supply Chain Security
29mState of the secure software supply chain
36mPolicy To Pipeline: How OSPOs Can Power Regulatory Readines...
54mSupply Chain Sec /w Dependency Track
32mSoftware Supply Chain Security
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue