Securing OSS across the whole supply chain and beyond
summary
Details: argues that combining SBOM (SPDX/CycloneDX) inventory at source build and package, Sigstore keyless OIDC signing for artifacts, and Confidential Computing (Intel SGX, AMD SEV, ARM CCA) TEEs with remote attestation closes most supply‑chain gaps. Cites SolarWinds as a build compromise, event‑stream and package squatting as dependency attacks, and notes US policy moving SBOMs toward mandatory use. Demonstrates signing of SBOMs and attested runtimes so artifacts prove provenance and code/data remain protected even on compromised hosts.
AI-written summary · about
chapters (9)
- 0:00Introduction and open source importance
- 1:28Open source supply chain overview
- 5:04Supply chain threats A to H
- 12:57SBOMs and their role
- 16:17Sigstore and signing artifacts
- 18:49Modern deployment challenges
- 20:35Confidential computing explained
- 28:14Summary and call to action
- 30:00Q&A session
related talks
29mState of the secure software supply chain
22mTop 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply Chain
40mPractical guides for enhacing your Software Supply Chain Security
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
14mKeynote: The Next Steps in Software Supply Chain Security
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
11mOSS Supply Chain Security
39mOpen Source Software Supply Chain Security — Why does it matter?