Easier, Faster, and Safer Open Source Consumption Governance
summary
Over 12 years Vanguard builds an internal package registry (2012), adds CI, then a manual artifact request flow (2017) with lawyers and security pros, automates intake with a custom techbot (2018) and finally proxies public registries (2019) enforcing license lists and a quarantine workflow; result: ~5,000 developers, proxying at scale (tens of millions of artifacts), ~95% auto-approve, ~5% quarantined, installs move from days to seconds, tooling includes Nexus, Sonatype/JFrog, OSV scanning, and a 2022 contribution ticket flow.
AI-written summary · about
chapters (13)
- 0:00Introduction and company background
- 3:30Why regulated firms fear open source
- 4:35Phase 1: Internal package registries
- 9:32Phase 2: Process-driven consumption
- 12:36Phase 3: Automated consumption
- 14:45Phase 4: Registry-based governance
- 17:55Phase 5: Revamped contribution process
- 19:39Key lessons and cultural shifts
- 21:51Q&A: Developer access and container scanning
- 24:18Q&A: Dependency approval in flagship products
- 26:06Q&A: Handling CVE patches and exceptions
- 28:53Q&A: End-of-life and scanning tools
- 30:16Q&A: Registry update frequency
related talks
17mBuilding Secure Open Source Communities From the Ground Up
32mFrom Code to Trusted Release
40mCurating and Securing Open Source for the GovCloud
33mOpen-Source Maturity in a 160-year-old organization: Technical and Legal hurdles
37mStreamlining Open-Source License Compliance With the Continuous Clearing Tool
18mSecuring Open Source in Nomura’s Software Supply Chain
42mThe Data Behind DevSecOps: The Power of Hindsight to Protect your Supply Chain
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance