Rethinking the Software Supply Chain: Trust, Minimalism, and Resili...
summary
Containers on Docker Hub exceed 20 billion image pulls per month across 14 million images and the claim is that minimal, policy‑enforced builds cut risk: examples include a Postmark MCP server backdoor and the Phantom Raven sequence of dynamic npm dependencies plus name squatting, both amplified by agentic AI. Proven tools cited are SBOMs, OpenVEX/VEX, Sigstore/cosign and Salsa and the recommendation is CI automation for signed provenance, continuous scanning and prioritized VEX‑driven remediation.
AI-written summary · about
related talks
28mBuilding Images for the Secure Supply Chain
40mSoftware Supply Chain Aspects in Infrastructure as Code, and How to Secure it
32mWhat Data Tells Us About Software Supply Chain Security & What To Do About It
45mPractical Software Supply Chain Security Solutions
38mSecuring the chains: Building defensive layers for software supply chains
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
08mHow to Master Your Software Supply Chain
34mImmutable Awesomeness?