The Secure Software Supply Chain
summary
Explains why SolarWinds-style compromises make the build system a threat vector, shows a simple Go user service binary, and demonstrates practical fixes: sign Git commits with GPG, vendor dependencies or use Go modules + sum files, and generate SBOMs and scan them with Grype. Shows storing SBOMs and detached signatures in registries using cosign/Sigstore, describes 18,000 affected customers and why reproducing builds matters for long-term trust.
AI-written summary · about
chapters (22)
- 0:00Start
- 2:23Average Developer Workflow
- 2:57Solarwinds
- 4:04How Do We Find Out about Most Security Vulnerabilities
- 8:46Sign Your Commits
- 9:45Step Two Start Signing Your Commits
- 12:54Software Bill of Materials
- 29:11The Best Way To Write Secure and Reliable Applications
- 29:29Getting Started Guide
- 30:02Build Your Application
- 32:16Audience Questions
- 34:13What Does It Mean To Be a Trusted Bill Service
- 35:42Software Dependencies
- 36:54Who Works on Open Source Software
- 39:51Public Questions
- 40:47How Do You Secure Your Gpg Key
- 41:07Keyless Signing
- 42:56How Do You Know these Tools Are To Be Trusted
- 45:34How To Protect against Malicious Insiders
- 51:17Serverless Frameworks
- 52:33How Does Commit Signature Behave When You Have Auto Merge Features with Pull Requests
- 55:31Final Thoughts
related talks
29mState of the secure software supply chain
39mReflections on Trust in the Software Supply Chain
12mAs Strong As the Weakest Link: Securing the Software Supply Chain
30mSecuring Open Source Supply Chains
54mSupply Chain Security for OpenSource Projects
36mBuilding a Trusted and Resilient Software Supply Chain
29mSupply Chain Security: Threats, Defenses And What You Can Do
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page