the AI Software Supply Chain
summary
Argues for a signed central artifact registry as the single source of truth to avoid locally built jars and unreproducible snapshots, and shows how governance shifts when agents write code so build vs buy becomes a hybrid with no clear accountable vendor. Recommends coupling vulnerability scans with compatibility impact analysis so developers act, and treating ML like software by producing version-stamped model weights, recording every build/train/deploy event, and avoiding opaque API-hosted models (Hugging Face, Codex/Gemini/Opus) without immutable provenance.
AI-written summary · about
chapters (8)
- 0:00Introduction and welcome
- 1:18Speaker’s background and journey
- 3:06Centralizing artifact management at scale
- 6:43AI agents and open source governance
- 9:51Evolving build vs buy in AI era
- 13:23Governance at high velocity
- 19:18Traceability in AI/ML supply chain
- 24:52Future of software quality
related talks
33mAI sovereignty, provenance and compliance
45mSecuring Software Supply Chain: Problems, Solutions, and AI/ML Challenges
23mMastering Secure Software Supply Chains
22mThe AI Accountability Mandate: Securing the Software Supply Chain
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
25mYour Software Supply Chain is Only as Secure as its Weakest Link
44mThe New Normal: Collaborative Strategies in a Regulated, Secure, and AI World
12mSolving the AI Accountability Crisis in the Software Supply Chain