Why You Should Care About Open Source Supply Chain Security

This talk explains how software supply chain attacks happen and why open source ecosystems are vulnerable. It introduces security concepts and frameworks for protecting software integrity and evaluating the practices of dependencies.

Syllabus

Intro
OPEN SOURCE SUPPLY CHAIN SECURITY (AND WHY YOU SHOULD CARE)
OVERVIEW
AFFECTING OPEN SOURCE ECOSYSTEMS
UNAUTHORIZED CHANGES
COMPROMISED SOURCE REPO
BUILD FROM MODIFIED SOURCE
COMPROMISED BUILD PROCESS
USE COMPROMISED DEPENDENCY
UPLOAD MODIFIED PACKAGE
COMPROMISE PACKAGE REPO
USE COMPROMISED PACKAGE
WHAT QUESTIONS MIGHT WE WANT TO ANSWER?
TERMINOLOGY
SIGSTORE
SLSA EXPLAINED
SLSA 1.0
EVALUATING RISKS
TRANSITIVE DEPENDENCIES
WHAT'S THE LATEST AND GREATEST?
SUPPORT OPEN SOURCE