Project ESSTRA : A software suite to enhance software transparency and traceability in the software supply chain
summary
ESSTRA is an open-source suite from Sony that adds provenance metadata to compiled binaries by using a GCC plugin to record which source files were used during builds and a Python tool to manage and embed that data. The talk covers how to use ESSTRA with open-source projects to catalog dependencies, generate SBOM-relevant information, improve vulnerability and license traceability, and the current status and packaging of ESSTRA in Debian (including discussion of integrating its data into -dbgsym packages).
AI-written summary · about
related talks
30mSupply Chain Security for OpenSource Projects
28mSPDX: Tackling System Risk in Modern Supply Chains
28mThe role of CDEs in securing your software supply chain
14mKeynote: The Next Steps in Software Supply Chain Security
23mSupply Chain Security using Free and Open Tools
40mStrengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption
35mOpen Source Software (OSS) Transparency for Acquisition
38mSafe Systems with Linux