SBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End
summary
SBOMs only inventory components and do not stop tampering; SLSA identifies nine distinct threat areas from source to distribution. The demo stitches gituff branch policies, in-toto attestations recorded by witness during the build, sbombit-generated SBOMs derived from those attestations, sigstore signing, and distribution via TUF/tough. Each artifact’s signatures and hashes are verified end-to-end and match expected values, demonstrating a reproducible pipeline that detects repository policy changes, build tampering, and repository compromise.
AI-written summary · about
chapters (15)
- 0:00Securing software supply chains
- 1:07What is the software supply chain
- 2:30SBOM limitations in security
- 3:36Securing source code with GitU
- 7:10Verifiable evidence with Inoto
- 10:49Accurate SBOMs with SBOMit
- 13:16Securing distribution with TUF
- 16:08End-to-end demo
- 24:50Adopting projects independently
- 25:18Q&A
- 30:02High-profile supply chain attacks
- 33:14Inoto attestations for policy
- 34:40Solutions for commercial use
- 35:42Multi-tier supply chains with Inoto
- 37:07Closing remarks
related talks
46mSBOMs Are Not Enough
27mSBOM: The Rest Of the Story
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
45mSmarter Than Your Average SBOM!
36mSBOMs, VEX, and Kubernetes
41mYour SBOM Is Lying To You – Let’s Make It Honest