Ketchup, Mustard, and Relish...
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 11:25· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Panel covers concrete outputs: SLSA 1.0 (April, 3 build levels) defines provenance, unforgeable attestations and isolation strength for build platforms; the spec deliberately trimmed features from 0.2 to ship a stable baseline. S2C2F for consumers, dependency management adds audit controls, produced a hackathon attestation tool that emits machine-readable assertions. FRSCA / Fresca implements the reference architecture using tecton chains spiffy Spire Q language to build secured pipelines. GUAC 0.1.x graph ingester collects SBOMs, attestations and scorecards to find gaps and impacted artifacts.
AI-written summary · about
chapters (18)
- 0:00OpenSSF Supply Chain Integrity WG intro
- 7:25Panelist introductions
- 9:51SALSA overview and purpose
- 10:58Fresca secure software factory
- 11:41S2C2F secure supply chain
- 12:23GUAC artifact composition
- 13:29SALSA deep dive for devs
- 14:32SALSA compliance role
- 15:40S2C2F vs SALSA comparison
- 17:47S2C2F compliance balance
- 19:35Status of SALSA after version 1.0 release
- 21:43SALSA versioning changes
- 25:37SALSA future challenges
- 28:48SALSA security accessibility
- 33:16S2C2F framework status
- 35:20GUAC progress update
- 38:10Get involved with OpenSSF
- 39:37Upcoming SALSA tech talk
related talks
40mKetchup, Mustard, and Relish...
46mPanel Discussion: Ketchup, Mustard, and Relish of Software Supply Chain Security
40mImproving Supply Chain Integrity with Ope...
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
38mSecuring Your Supply Chain by Building with FRSCA
33mSLSA FRSCA Recipe For Secure Supply Chain
24mSecuring Software Supply Chains for the Public Good
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1