State of the secure software supply chain

on YouTube ↗29m

" summary

SolarWinds supply chain compromise motivates concrete defenses: ingest dependencies with SBoMs (SPDX or CycloneDX), scan them, and copy into a local registry; attest build steps with in-toto and short‑lived node identity via spiffy/spire or TPMs (keylime), then sign with HSM-backed APIs (parsec or Vault/transit) and publish signatures alongside images (cosign + rekor / notary v2 + OCI reference types). Reproducible builds and admission controllers (OPA Gatekeeper) close rollback, replay, and dependency‑confusion gaps.

AI-written summary · about

" chapters (12)

1. 0:00Introduction
2. 0:46Recap
3. 1:21Supply chain attacks
4. 2:31dependency confusion attacks
5. 6:45harden your environment
6. 9:35software build materials
7. 12:35attestation
8. 15:04signing
9. 17:53trust
10. 22:38related projects
11. 24:56reproducible builds
12. 27:51wrap up

" related talks

• 57mThe Secure Software Supply ChainKelsey Hightower · Craft Conference 2022
• 37mSecuring OSS across the whole supply chain and beyondNick Vidal · FOSS Backstage 2023
• 15mSoftware Supply Chain Security for those in a rushAbdel Sghiouar · Voxxed Days Thessaloniki 2023
• 39mReflections on Trust in the Software Supply ChainJeremy Long · Black Hat USA 2023
• 23mMastering Secure Software Supply ChainsDasith Wijesiriwardena, Juan Burckhardt, Jason Goodsell · apidays Australia 2023
• 12mAs Strong As the Weakest Link: Securing the Software Supply ChainBrendan O'Leary · Cloud Native Security Conference North America 2021
• 29mSupply Chain Security: Threats, Defenses And What You Can DoYesenia Yser · PNSQC 2022
• 39mOpen Source Software Supply Chain Security — Why does it matter?Mikaël Barbero · EclipseCon 2022