OmniBOR: Bringing the Receipts for Supply Chain Security
summary
OmniBOR captures a canonical Merkle DAG of every build artifact by recording file-level git OIDs (20-byte SHA-1 by default with migration paths toward SHA-2) as cryptographic receipts, then decorates those OID nodes with external metadata (scanners, license, who compiled). Implementations exist for Go, Rust, LLVM and GCC work is underway, with six total implementations mentioned; integration with SPDX 2.3 and in-toto/witness provides attestations. Target is gitoid Merkle DAG, produced with no developer effort, and usable to tag compromised nodes later.
AI-written summary · about
chapters (5)
- 0:00Start
- 5:48Simplifying perspective change
- 6:19Simple Questions
- 8:26Identity: non-solutions
- 14:36Dependency: what is in this artifact? Artifact Dependency Graphs (ADC)
related talks
41mOmniBOR: Bringing the Receipts for Supply Chain Security
43mGitBOM: Repurposing Git’s Graph for Supply Chain Security & Transparency
35mRepurposed Purpose: Using git's DAG for Supply Chain Artifact Resolution
11mLightning Talk: Repurposed Purpose: Using Git's DAG for Supply Chain Artifact Resolution
20mDo You Know What's in the Software You Run? Introducing GitBOM
35mAchieving End-To-End Software Supply Chain Security With in-toto
37mSecuring OSS across the whole supply chain and beyond
28mBuilding Images for the Secure Supply Chain