Supply Chain Security using Free and Open Tools
summary
Focuses strictly on dependency management: create an inventory with SBOMs (SPDX or CycloneDX), scan artifacts and running images, and automate updates. Demonstrations show generate SBOMs at build time using the sift CLI to produce SPDX/CycloneDX, feeding images into Dependency-Track via an SBOM operator that annotates Kubernetes deployments and reports vulnerabilities, and using Renovate (or Dependabot) to open grouped PRs for npm/Maven/Helm/Terraform and Docker updates. Notes false positives and recommends CI pipelines to raise merge confidence.
AI-written summary · about
chapters (11)
- 0:00Supply chain security intro
- 1:14Why security matters now
- 2:16Dependency problem
- 4:03Three steps to improve
- 5:09Software bills of materials
- 6:32Demo: Sifting dependencies
- 9:22Demo: Tracking with Dependency-Track
- 13:00Scanning for vulnerabilities
- 14:47Auto-updating dependencies
- 15:51Demo: Renovate updates
- 21:12Conclusion and key takeaways
related talks
38mSecuring the chains: Building defensive layers for software supply chains
30mSupply Chain Security for OpenSource Projects
21mSecuring Diverse Supply Chains Across Interconnected Systems
54mSupply Chain Sec /w Dependency Track
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
25mA Primer on Software Bill of Materials for DevSecOps
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
36mSBOMs, VEX, and Kubernetes