What Is Going On In Your Source Code? Understanding SCA In Plain Language
summary
Breaks down software composition analysis into concrete checks: generate SBOMs + VEX attestation (CycloneDX / in-toto JSON), map known flaws via CVE/CVSS/EPSS/KEV, and validate build integrity with SLSA levels 0–3 and attestations so diffs and hashes catch tampering (XZ example). Promotes GUAC to turn attestations into a queryable GUAC graph queries view of who/what is affected, and stresses licenses, reachability limits, and practical tradeoffs for real-world SCA.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker intro
- 3:32Why software supply chain security matters
- 11:21Expected code and vulnerabilities
- 17:26Expected licenses and risk
- 22:47Handling attestation failures
- 24:59What is SCA and tools overview
- 28:53Resources and closing
related talks
33mWhat Good Is SCA If You Depend on 666 Packages?
46mSCA for Containers: The Good, the Bad, and the Truth- 46mSCA for Containers: The Good, the Bad, and the Truth
44mUsing Static Analysis Tools to Become A Superhero Programmer
37mEliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...
23mSBOM adopatability in open source software scanning
40mStrengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption
14mKeynote: The Next Steps in Software Supply Chain Security