How the Argo Project Transitioned From Security Aware To Security First
summary
Argo recounts concrete changes: after 15 CVEs in four months and a vendor-driven zero day that triggered major press, the project creates a permanent private security SIG Slack channel, a private GitHub playbook with an issue template checklist, and a repeatable embargo process. Engineering work includes SBOMs and fuzzing, signed binaries, cryptographically secure randoms, path-hardening for repo cache and symlink rejection, and a new security field in structured logs; these measures reduce repeat vulnerabilities and improve coordinated, multi-version patching.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:22Al-driven expert platform
- 1:58We believe in open source and open collaboration
- 2:41Argo Project Background
- 9:05Adding Security Strategy and Posture
- 10:09Having a Place to Talk
- 11:48Formation of Argo SIG Security
- 16:56Formalizing and Documenting Process
- 23:23Engineering Best Practices - SBOMs
- 24:38Engineering Best Practices - Fuzzing
- 25:33CNCF/Community Project Resources
related talks
22mWelcome + Project Updates
07mBuilding on Argo and Open Source
31mAttacking Argo CD with Argo CD (and then Defending)
12mWelcome + Opening Remarks - Building the Argo Community
28mDissecting the Discovery of the 0-Day Supply Chain Vulnerability in Argo CD
23mA Practical Guide to ArgoCD Security Gating
22mUsing Argo Project to Help Elastic infoSec Team in Securing Elastic
26mThreat Model Report: Security Considerations for Hardening D...