~/talk

Understanding, maintaining and securing Envoy's supply chain

on YouTube 29m
Talkat EnvoyCon 2020 Virtual · on Thursday, 2020-10-15· at 11:30· Virtual, Virtual· [security, open-source]

speakers

name:Michael Payne
links:none on file
name:Harvey Tuch
links:none on file

resources

video:https://youtu.be/0VRY1FkeKxw
slides:none on file

summary

Envoy depends on roughly ~60 external dependencies and about 170,000 lines of C++ in the trusted compute base, with data plane libraries like quiche and BoringSSL and a high-CVE outlier libcurl (about 14 CVEs since 2018). Maintenance relies on Bazel-based builds, an RSS-driven release watch, and integrity checks using SHA256 hashes and hashen for Python. Strategies include removing the kitchen-sink image by compiling out extensions, producing a BOM dashboard, and enforcing dependency policy with versioning, peer review and fuzz testing.

AI-written summary · about

chapters (7)

  1. 0:00Start
  2. 3:30Envoy.debug_line binary analysis (Lines)
  3. 5:08Envoy debug_line binary analysis (Core vs. extensions)
  4. 5:39Envoy.debug_line binary analysis Organization
  5. 6:22Envoy.debug line binary analysis (CVE count 2018-now)
  6. 7:43Envoy debug line binary analysis (repository locations.bzl updates 2018-now)
  7. 8:15Envoy debug_line binary analysis (Tagged releases 2018-now)

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.