Airflow Beach Cleaning - Securing Supply Chain
summary
Experimental collaboration funded by Alpha-Omega reviews and hardens Airflow’s 700+ dependencies, starting with a Python script plus OpenSSF/scorecard-style automation and SBoM data to prioritize work. Hands-on outreach drives fixes: 16 pilot projects see human triage, PRs and CI hardening produce fast remediation, plus reproducible builds and a dedicated security team supported by Sovereign Tech Fund. Goal is a three-year effort to teach downstream projects to clean their own beaches and scale via transitive maintainer engagement.
AI-written summary · about
chapters (20)
- 0:00Introduction and speaker background
- 1:03What is supply chain risk
- 2:25Why dependencies matter now
- 4:08Three Fs framework for dependencies
- 5:13Funding open source security
- 8:04Origin of beach cleaning concept
- 9:31Airflow project scale and activity
- 11:35Security improvements funded by Sovereign Tech
- 13:23Stakeholders and security regulations
- 14:48Challenges in open source security
- 16:14Starting the dependency review process
- 18:01Human connection in security fixes
- 19:48Reactions from dependency maintainers
- 21:16Scaling the methodology
- 22:41How others can start similar efforts
- 23:45Building a security-minded community
- 24:08Key takeaways and final advice
- 25:12Q&A: CRA and project foundations
- 27:40Q&A: Abandoned projects and foundations
- 28:01Q&A: Plugin ecosystems and standards
related talks
28mAirflow Beach Cleaning - Supply Chain Security with Community in Mind
45m"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
55mReviewing another year of security partnership between the PSF & Alpha-Omega
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
53mAlpha-Omega: What We've Learned From Funding Open Source Security Over the Past 3Years, What's Ahead
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
22mImproving Global Software Supply Chain Security with Alpha-Omega
17mGoing with the flow? Apache Airflow for operational-quality scientific workflows