Keynote: Security of the Open Source Supply Chain, a Call to Action
summary
Argues that supply chain security is urgent and actionable, citing Kubernetes’ dependency matrix at 513 and React Native yarn files with 7,109 lines to show scale. Describes a recall prototype that logs build metadata and sigstore (90+ contributors, ~500 PRs/month) aiming to provide ubiquitous signing and a free public-good service; details Tekton Chains adding attestations, in-toto for provenance/SBOMs, The Update Framework for key compromise/delegation, SPIFFE/SPIRE for identity, and Keylime for runtime measurement — all working components under active adoption.
AI-written summary · about
related talks
12mKeynote: A Vision for a Secure Software Supply Chain
11mKeynote: Securing Open Source
30mSecuring Open Source Supply Chains
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
14mKeynote: The Next Steps in Software Supply Chain Security
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
04mKeynote: A Secure Supply Chain Vision
39mOpen Source Software Supply Chain Security — Why does it matter?