Software Supply Chain Security Case Study at Anaconda
summary
Anaconda implements end-to-end content trust for its curated package build pipeline: packages are built and metadata is signed at build time, verification checks hashes and dependencies at install, and a conda signature verification feature is available and functioning for curated channels. The design uses TUF, Sigstore, in-toto ideas: ed25519 keys on hardware tokens, offline root key ceremonies, delegated signing, and threshold signatures for compromise resilience. Bootstrapping relies on installer-embedded root metadata; deployed to curated channels serving ~30 million monthly users with ongoing rollout to community channels.
AI-written summary · about
chapters (18)
- 0:00Software supply chain security intro
- 1:26User perspective on security
- 5:38Content trust at NYU
- 8:27Anaconda and conda overview
- 10:14Securing conda installations
- 13:02How conda installs packages
- 17:37Digital signatures for integrity
- 19:03Update Framework design
- 22:34Conda signature verification
- 27:55Verifying signatures and dependencies
- 30:42Signing packages in channels
- 32:28Hardened vs basic trust designs
- 33:51Bootstrapping conda trust
- 36:22Security as architectural challenge
- 37:04Threat modeling and complexity
- 39:31SLSA compliance framework
- 40:56Regulations and security tooling
- 42:20Security champions program
related talks
32mSoftware Supply Chain Security
33mWhat is the secure software supply chain
27mBuilding Trust Through Proactive Security - Key Parts of the Trusted Software Supply Chain
45mSponsored Session: Because Security Matters: Securing Your Open Source Supply Chain
43mBuilding Trust Through Proactive Security - Key Parts of the Trus...
23mMastering Secure Software Supply Chains
32mState of the Art Supply Chain Security
29mState of the secure software supply chain