Improving Supply Chain Integrity with Ope...
summary
OpenSSF technologies target concrete gaps: Salsa v1 defines three incremental build-integrity levels plus a provenance document and is expanding to protect source, dependencies, and build platforms; S2C2F is a consumption framework with eight practices and four maturity levels now entering the PAS standards fasttrack for wider adoption; GUAC ingests SPDX/CycloneDX SBOMs, SLSA provenance, scorecards and OSV into a graph and exposes a Guac GraphQL API for queries, nearing 1.0 and already used to answer exposure and blast‑radius questions.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:56Open source supply chain threats
- 5:29OpenSSF founding and relaunch
- 7:15Supply Chain Integrity Working Group
- 9:20Salsa overview and components
- 10:23S2C2F framework intro
- 11:06GUAC role and explanation
- 13:58Tools in practice
- 17:49Salsa status and expansion
- 20:19S2C2F progress and adoption
- 22:31GUAC ingestion and output
- 23:56Technology challenges
- 29:07Panelists on supply chain risks
- 32:14Critical infrastructure recommendations
- 38:54Closing and getting involved
related talks
46mPanel Discussion: Ketchup, Mustard, and Relish of Software Supply Chain Security
44mImproving the Software Supply Chain Security
52mIntroducing the Secure Supply Chain Consumption Framework (S2C2F)
11mOSS Supply Chain Security
14mKeynote: The Next Steps in Software Supply Chain Security
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
30mSecuring Open Source Supply Chains
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...