From Code To Kernel - Enforcing Supply Chain Security for Linux Distributions

Learn to implement comprehensive supply chain security measures for Linux distributions through this 14-minute conference talk that addresses critical vulnerabilities from source code to kernel deployment. Explore the rising threats of dependency poisoning, malicious injections, and package manager compromises that make supply chain security essential for modern Linux environments. Discover practical frameworks for verifying source authenticity using cryptographic signing and reproducible builds, while mastering automated SBOM (Software Bill of Materials) generation to track dependencies and prevent sophisticated supply chain attacks. Examine how to enforce integrity using industry-standard open-source tools including Sigstore components (Cosign, Rekor), in-toto, and OpenSCAP for comprehensive security validation. Analyze real-world attack scenarios and their corresponding mitigation strategies to understand how threats manifest in production environments. Gain actionable strategies for preventing tampering, detecting anomalies early in the development pipeline, and ensuring trusted software delivery across open-source Linux distributions, equipping you with the knowledge to secure the entire software supply chain from development to deployment.