Lightning Talk: A Supply Chain Security View of OpenSearch
summary
Quick audit of OpenSearch security posture with concrete fixes and tools: shows an OpenSSF best practices badge, runs OpenSSF scorecards and an OSV scanner against the repo and container images, finds a surprising ~26 CVEs resolvable by a simple Go 1.24 → 1.24.x bump, and recommends producing SBOMs and feeding them into Guac/GraphQL for dependency graphs and attestations so maintainers can fix low-effort, high-impact issues.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:04Supply chain security in open source
- 3:31OpenSSF role in securing open source
- 4:36OpenSSF badge in OpenSearch
- 5:41OpenSSF Scorecards for security
- 7:07OSV scanner and vulnerabilities
- 8:32Importance of SBOMs
- 9:35Demo: Guac for dependencies
- 10:17Closing remarks
related talks
10mLightning Talk: Secure Consumption of Open Source Software: Evaluating, Util...
05mKeynote: OpenSearch, Open Security: Bringing Transparency to Our Security Processes
28mProduction, Consumption, and the Data: The Open Source Security Sandwich
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
40mImproving Supply Chain Integrity with Ope...
44mPanel Discussion: Improving the Software Supply Chain Security
44mOpen Source Security: The World Needs Our Help
42mDeveloping a Secure, Open Future