OmniBOR: Bringing the Receipts for Supply Chain Security

on YouTube ↗41m

" summary

OmniBOR (Omnivore) captures a build’s exact artifact dependency graph by having build tools embed input-manifest IDs (git object hashes) into outputs, turning nested inputs into a tamper-resistant Merkle ADG. Proofs of concept exist for clang/LLVM, GCC/binutils, Go, Rust, Debian and Docker; a Linux kernel graph shrinks SBOM data from ~1 GB to ~1 MB, enabling precise CVE-to-file mapping and far fewer false positives. Tooling is mostly POC and upstream work is ongoing; public global databases are not yet available.

AI-written summary · about

" chapters (46)

1. 0:00Intro
2. 0:44Backstory
3. 1:31Am I safe
4. 2:10Sbombs
5. 3:52What is Trust
6. 4:24Time dependent
7. 4:56Build process
8. 5:30Deep scanning
9. 6:07Build tools
10. 6:35What is a build tool
11. 6:56Compilers
12. 7:38Linkers
13. 8:00Shared Objects
14. 9:18Code Generators
15. 10:06RPM Files
16. 10:50Polyglot
17. 12:44Artifacts
18. 14:06Nonsolutions
19. 14:44Minimum elements
20. 15:07Minimum identifiers
21. 15:43How to identify things
22. 16:06Git
23. 16:19Object IDs
24. 17:18Generalizing
25. 17:37Input manifest
26. 18:13Input manifest identifier
27. 18:39Embed input manifest identifier in output artifacts
28. 20:05Artifact dependency graph
29. 20:45Merkle tree
30. 21:36OmniBOR
31. 23:47OmniBOR Community
32. 27:16What is an Sbomb
33. 29:35cbes
34. 31:04patch
35. 32:08response teams
36. 32:31questions
37. 33:07open database
38. 33:54artifact dependency graphs
39. 34:30call your supplier
40. 34:44adoption tooling
41. 35:45call for action
42. 36:11hash
43. 36:25sha
44. 37:51the blog post
45. 39:01the build tool
46. 40:04broken reproducibility

" related talks

• 31mOmniBOR: Bringing the Receipts for Supply Chain SecurityFrederick Kautz · CloudNativeSecurityCon North America 2023
• 35mRepurposed Purpose: Using git's DAG for Supply Chain Artifact ResolutionEd Warnicke · cdCon 2022
• 43mGitBOM: Repurposing Git’s Graph for Supply Chain Security & TransparencyAeva Black, Ed Warnicke · SupplyChainSecurityCon at Open Source Summit North America 2022
• 20mDo You Know What's in the Software You Run? Introducing GitBOMNell Shamrell-Harrington · SupplyChainSecurityCon at Open Source Summit Europe 2022
• 11mLightning Talk: Repurposed Purpose: Using Git's DAG for Supply Chain Artifact ResolutionAeva Black · Cloud Native SecurityCon Europe 2022
• 39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...Paul Novarese · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 28mBuilding Images for the Secure Supply ChainAdrian Mouat · Cloud Native SecurityCon North America 2022
• 37mSecuring OSS across the whole supply chain and beyondNick Vidal · FOSS Backstage 2023