Keynote: Securing Shopify's Software Supply Chain
summary
Shopify describes concrete controls: codify build recipes with in-toto so builds are reproducible, scan artifacts with trivy and produce SBOMs in CycloneDX, and refuse deployments that lack attestations using voucher + binary authorization. Cites real incidents — Codecov bash uploader exfiltrated env vars, SolarWinds and left-pad caused widespread breakage — and adds runtime detection with Falco, plus SLSA guidance, to measure and block compromised dependencies before they reach production.
AI-written summary · about
chapters (5)
related talks
12mKeynote: A Vision for a Secure Software Supply Chain
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
15mSoftware Supply Chain Security for those in a rush
11mKeynote: Securing Open Source
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
08mKeynote: Security of the Open Source Supply Chain, a Call to Action
33mWhat is the secure software supply chain
19mKeynote: Supply Chain Security in 2024