GitBOM: Repurposing Git’s Graph for Supply Chain Security & Transparency
summary
Proposal repurposes Git object ids to use git OIDs as canonical artifact IDs and defines a tiny file format where each build emits a gitbom document that captures the merkle DAG of source files through compilers and linkers. Proofs of concept integrate with SPDX 2.3 so you can reference gitbom from SPDX, embedding a build tree gitoid in artifacts to enable high precision CVE mapping and artifact resolution across languages with zero developer effort and several community POCs and launches already underway.
AI-written summary · about
chapters (5)
- 0:00Start
- 19:17Metadata
- 25:14Scanning the Input
- 37:11How Does Git Bomb Intersect with Reproducible Builds Effort
- 38:03Define the Reproducibility of a Build
related talks
11mLightning Talk: Repurposed Purpose: Using Git's DAG for Supply Chain Artifact Resolution
35mRepurposed Purpose: Using git's DAG for Supply Chain Artifact Resolution
20mDo You Know What's in the Software You Run? Introducing GitBOM
31mOmniBOR: Bringing the Receipts for Supply Chain Security
41mOmniBOR: Bringing the Receipts for Supply Chain Security
35mAchieving End-To-End Software Supply Chain Security With in-toto
15mFinding Your Way: A Survey of Supply Chains
36mSBOMs, VEX, and Kubernetes