A Community Approach to OSS Distribution

on YouTube ↗51m

" summary

Pyrsia builds a decentralized OSS distribution network that uses peer-to-peer via libp2p, authority nodes that run consensus (requires compromising two‑thirds to forge history), and an immutable transparency ledger recording verified builds. Packages are reproduced on multiple authority build nodes and accepted only when checksums match—guaranteeing “what you download equals what you would build from source.” Early integrations include Docker and Maven; project sits at roughly 0.3/0.4 and relies on community curation and multi-node reproducible builds for security and reliability.

AI-written summary · about

" chapters (46)

1. 0:00Introduction
2. 1:30Why we need OSS
3. 2:00Attacks on the software supply chain
4. 2:25SolarWinds incident
5. 3:45Log4J incident
6. 4:05Log4J attack
7. 4:35Circle CI attack
8. 6:25Software supply chain vulnerabilities
9. 6:43Central repositories
10. 7:10Thumb drives
11. 7:45dependency confusion attack
12. 8:00bug bounty
13. 8:37custom DNS server
14. 9:33npm
15. 10:20vulnerable libraries
16. 10:38package managers
17. 11:02bug bounties
18. 11:26PiPi
19. 11:58Vetter
20. 13:15Pi Noblesse
21. 14:12What they were doing
22. 14:46They would do is
23. 15:00go and pull this information from
24. 15:21typo squatting
25. 16:08Azure Core Tracing
26. 17:30Security Research
27. 18:01Rust Exploit
28. 18:41Persia
29. 19:51Torches
30. 20:48Software Supply Chain
31. 22:52Open Source Distribution
32. 23:05Reliability
33. 27:57Build Verification
34. 29:42immutable transparency ledger
35. 31:02vulnerable versions of libraries
36. 34:02can bad actors take over the network
37. 37:14the CD Foundation
38. 37:49Architecture diagram
39. 39:58Authorized nodes
40. 40:54Other nodes
41. 41:25Persia Architecture
42. 44:42Where to find Persia
43. 45:11Persia Community
44. 45:46GitHub
45. 46:04Raffle
46. 46:32Additional Questions

" related talks

• 10mHacking the OSS Supply ChainStephen Chin · Continuous Delivery Summit 2022
• 17mTrusted Open Source Artifacts on the Blockchain: A Hands-on Introduction to PyrsiaAdam Gardner · cdCon + GitOpsCon 2023
• 26mand Pyrsia: Securing the Software Supply ChainChris Crone, Sudhindra Rao · DockerCon 2022
• 29mClosing the Supply Chain Security Loop with Rust & PyrsiaStephen Chin, Joel Marcey · Continuous Delivery Summit 2022
• 28mOscoin: A P2P Alternative for OSS CollaborationEleftherios Diakomichalis · Web3 Summit 2018
• 30mSupply Chain Security for OpenSource ProjectsSven Ruppert · Conf42 Cloud Native 2023
• 30mBringing Continuous Delivery to Open SourceSudhindra Rao · Continuous Delivery Summit 2022
• 49mTrustworthy Open Source: The Consequences of SuccessEric Brewer · USENIX ATC '22