How to prove the safety of your software
summary
A concrete method to check software safety: generate an sbom with sift, analyze it with grype/grip and upload to dependency track for continuous matching against CVE feeds. A tiny Python app has one medium CVE, but packaging it on python:latest inflates the image from ~110 MB to 1.5 GB and adds ~1,699 vulnerabilities; switching to python:3.9.18-slim drops that to ~101 matches, and an Alpine build yields only a handful (one high, ~18 medium), no criticals.
AI-written summary · about
chapters (33)
- 0:00intro
- 0:20preamble
- 0:47short agenda
- 1:57for future use...
- 2:09from code to production
- 2:52a (random) app step by step: worker.py
- 3:36how is this done in the food industry?
- 3:50food safety
- 4:33it probably depends
- 5:02it is nice to know what's inside
- 5:42why not do the same with our
- 6:20boms are there to help
- 7:18why use sboms?
- 7:39did you see this?
- 8:05was your app affected?
- 8:45like food labels sboms tell you what's inside
- 10:21more and more you can download them upfront
- 11:39and analyze them before you install something
- 12:33back to our app: worker.py
- 12:47step 1: the code
- 13:10shipping the app
- 13:53building the container images
- 14:24build result
- 15:21sbom creation
- 16:13source code analysis
- 16:33our first image based on python:latest
- 17:29can we do better: python:3.9.18-slim
- 18:01let's try one more image: python:alpine
- 18:35summary
- 18:48storing sbom files
- 20:31distributing sbom files
- 21:40final words
- 22:54interesting links
related talks
35mSecuring Python projects Supply Chain
20mMinimum Viable Security for Python Applications
49mScratch containers and the supply chain trouble
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
47mSecure software supply chain on a shoestring budget
33mBuilding Images For The Secure Supply Chain
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
34mSBOMs: zero to hero in 25 mins!