Supply Chain Town Hall 2021
2021-08-18
-- online --
[SupplyChainSecurityCon @ OSS NA 2023, SupplyChainSecurityCon North America 2021, SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon at Open Source Summit Europe 2022, SupplyChainSecurityCon @ Open Source Summit Europe 2023, SupplyChainSecurityCon @ Open Source Summit North America 2024]
as the organisers put it
Learn how to best protect your supply chain and mitigate potential disasters from the experts at this Town Hall.
who it's for
security engineers, devops engineers, release engineers, platform engineers, embedded engineers, open source maintainers, compliance engineers
topics
SBOM generation and formats; SPDX tag-value and JSON; cosign-based signing workflows; Sigstore rekor and fulcio; OSS Review Toolkit (ORT) pipelines; bill of materials tooling for Kubernetes; Yocto/OpenEmbedded SBOM integration; CMake/west SBOMs for Zephyr; GCC and glibc hardening features; OCI registry artifact reference types
| title | author | length |
|---|---|---|
| Supply Chain Cybersecurity | David A. Wheeler | 11m |
Claim: open source dominates modern software supply chains with 98% include OSS and an average 70% OSS per codebase, and components per app rising from 84 in… | ||
| Generating SBOMs for IoT at Build Time | Steve Winslow | 28m |
Build-time SBOM generation for Zephyr uses the CMake file-based API plus a small west extension called west spdx to output SPDX tag-value documents that record… | ||
| Generating a SPDX SBOM for Your Code in CI Using ORT | Thomas Steenbergen | 28m |
Builds an automated CI pipeline using OSS Review Toolkit (ORT) to produce traceable SPDX SBOMs, downloading sources, running ScanCode, applying configurable… | ||
| Leverage Kubernetes SPDX Tools to Create Your SBOM | Adolfo García Veytia | 28m |
Kubernetes release automation produces dozens of artifacts (about 30 images, 53 binaries across six architectures and three OSes) and the team builds an SBOM… | ||
| Software Supply Chain with the Yocto Project | Joshua Watt | 32m |
Yocto/OpenEmbedded build flow uses BitBake to produce target images, SDKs and a build tools tarball; each recipe generates an SPDX archive and those are merged… | ||
| Securing GCC and GLIBC | Carlos O'Donell | |
GCC adds incremental prevention features: buffer bounds checking (improving since GCC 9), object-size detection, new static analyzers in GCC 10 and sanitizers… | ||
| Building Signing, Distributing SPDX SBOMs as Artifact Reference Type | Steve Lasker, Justin Cormack | 29m |
Demonstrates storing detached SPDX SBOMs and signatures as registry artifact reference types, using ORAS discover tree to view a graph of image → SBOM →… | ||
| Software Supply Chain Integrity with Sigstore | Marina Moore, Priya Wadhwa | 23m |
Sigstore provides a concrete pipeline: cosign (now at 1.0) generates ephemeral keys, signs container images or arbitrary files and stores signatures alongside… | ||
| Auto Generate SBOMs for Your Open Source Project Written in Any Language Running on Any Platform | Nirav Patel, Shubhra Kar | 29m |
A command line tool called the spdx sbom generator auto produces SBOM documents that conform to SPDX 2.2, is written in Go, and runs on macOS Linux and… | ||
| nothing matches | ||