Secure software supply chain on a shoestring budget
summary
The team industrializes supply-chain security by locking exact versions in a Bazel-based monorepo and automating safe upgrades with an automated dependency bot that runs pip-tools and bazeldeps, updates checksums, and opens merge requests. The bot generates ~10 merge requests per day and produced ~500 in three months; 90th-percentile checks for new versions are about one week. Builds run in reproducible container images, tests run in parallel, and the system mostly succeeds though one bot-driven upgrade once caused a production outage.
AI-written summary · about
chapters (30)
- 0:00Intro
- 1:28Losing battles
- 2:02What do we contribute?
- 3:53Security AND productivity
- 6:27We have been here before
- 7:57Quality and ops
- 8:26Manual, mechanised, industrialised
- 9:59IT craft to factory
- 11:13Quality, speed - choose two
- 13:15Themes of good presentations, IMHO
- 15:54Data industrialisation
- 17:23How data leaders work
- 18:54Efficiency is sacred
- 21:15Minimising attack surfaces
- 22:39Our supply chain
- 23:27Which version?
- 25:36Levels of up to date
- 28:06Strong process challenges
- 30:41Dependency version control
- 31:18bazel-deps
- 32:45Python vs JVM dependency failure
- 33:27Bazel & containers
- 34:41Can we make apt install deterministic?
- 36:09Scling collaboration models
- 37:24Divided, multi-tenant platform
- 38:29Client exit scenario
- 43:58Benderbot stats - resolutions
- 45:22Last resolution by dependency
- 46:25Concluding remarks
- 46:56Resources
related talks
38mSecuring the chains: Building defensive layers for software supply chains
23mSupply Chain Security using Free and Open Tools
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
33mWhat is the secure software supply chain
30mSupply Chain Security for OpenSource Projects
45mSponsored Session: Because Security Matters: Securing Your Open Source Supply Chain
49mMitigate Risks In Code: Protect Your Software based Supply Chain
36mSecuring the software supply chain