Panel Discussion: Ketchup, Mustard, and Relish of Software Supply Chain Security
summary
OpenSSF Supply Chain Integrity work focuses on concrete deliverables: Salsa 1.0: five build requirements (provenance, isolation, strength) after cutting ~20 original items to a laser scope; Fresca implements Salsa level 3 using Tekton, Tekton Chains, SPIRE/SPIFFE and has PRs to detect admin-side compromises; S2C2F: eight practices, four levels targets dependency consumption and governance. Specifications start as self-certification with a planned conformance/auditing program; implementations are already usable, not just aspirational.
AI-written summary · about
chapters (14)
- 0:00OpenSSF and supply chain security
- 3:56Panelist introductions
- 6:04Salsa framework deep dive
- 8:12Fresca build system
- 9:38S2C2F dependency management
- 11:26Salsa 1.0 improvements
- 18:34Who benefits from Salsa
- 23:07Fresca compliance timeline
- 24:31Salsa levels explained
- 28:05S2C2F vs Salsa positioning
- 30:33S2C2F future status
- 32:42Salsa threats and limits
- 37:17Salsa future tracks
- 44:46Get involved in OpenSSF
related talks
40mImproving Supply Chain Integrity with Ope...
40mKetchup, Mustard, and Relish...- 40mKetchup, Mustard, and Relish...
25mLet’s Talk Software Supply Chains with TAG Security
32mSoftware Supply Chain Security
14mKeynote: The Next Steps in Software Supply Chain Security
52mIntroducing the Secure Supply Chain Consumption Framework (S2C2F)
30mSecuring Open Source Supply Chains