The Whole Is Greater Than the Sum of Its Parts: A Case for Inte...
summary
Argues that supply chain security tools like in-toto, DSSE, Sigstore and SLSA work best together but fail to interoperate because of overlapping formats and storage encodings, causing maintenance and threat-modeling gaps. Demonstrates concrete fixes: protobomb for bidirectional SPDX↔CycloneDX conversion, bom-ctl using protobomb to bridge generation and analysis, and TUF/Git-TUF SDKs for update workflows. Defines composability vs integration, shows tradeoffs, reports libraries ease integration, and recommends cross-community collaboration, thinking about metadata consumption, and an end-to-end strategy.
AI-written summary · about
chapters (8)
- 0:00Supply chain security intro
- 1:05Software supply chain tooling
- 5:47Tooling adoption challenges
- 9:21Composability in tooling
- 15:03No single tool solves all
- 19:17AI model supply chain security
- 20:00Cross-community collaboration
- 21:27Q&A
related talks
14mKeynote: The Next Steps in Software Supply Chain Security
37mSecuring OSS across the whole supply chain and beyond
51mThe End of DevSecOps?
25mYour Software Supply Chain is Only as Secure as its Weakest Link
38mChallenge Accepted: 3 Experts, 3 Big Ideas on Supply Chain Security
21mSecuring Diverse Supply Chains Across Interconnected Systems
22mTop 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply Chain
01h 16mCybersecurity with CDF & OpenSSF Focus Group