Auto Generate SBOMs for Open Source Projects in Any Language and Platform
Learn to automatically generate Software Bill of Materials (SBOMs) for open source projects, enhancing security and compliance across languages and platforms.
Software Supply Chain Integrity with Sigstore
Learn about Sigstore, a tool for securing software supply chains, with demos on Cosign for signing and verifying artifacts, and insights on its practical applications.
Baking a Cake with Supply Chain Tooling - Securing Software from Scratch
Explore software supply chain security from an engineer's perspective, discussing tools, standards, and solutions for securing software from scratch.
Attesting Practically: Exploring the Glue Behind Secure Runtime Environments
Explore practical applications of attestations in software supply chain security, focusing on Cosign, in-toto, and VEX to create secure, auditable runtime environments and effectively manage security threats.
Introducing GitBOM: Tracking Software Dependencies and Improving Supply Chain Security
Explore GitBOM, an open-source scheme for tracking dependencies in software, enhancing security and transparency across languages and ecosystems. Learn implementation and benefits for your software supply chain.
Gitsign - Keyless Git Commit Signing
Explore Gitsign, a Sigstore project enabling keyless Git commit signing. Learn its functionality, integration with Sigstore, and application in development, CI/CD, and GitOps workflows.
Securing Your Supply Chain by Building with FRSCA
Explore FRSCA, an OpenSSF project implementing CNCF's Secure Software Factory Reference Architecture to protect against supply chain attacks and enhance build pipeline security.
What's in a Name - Vulnerabilities, SBOMs, and the Challenge of Software Identity
Explore software identity challenges in supply chain security, examining existing naming standards, potential risks, and collaborative solutions for effective vulnerability management.
State of SBOM Tools - Improving Software Supply Chain Security
Explore the current state of SBOM tools, discussing improvements, standards support, interoperability, and accuracy to enhance software supply chain security.
Are We Forever Doomed to Software Supply Chain Security?
Explore software supply chain security challenges, recent incidents, and strategies for mitigating vulnerabilities in open-source ecosystems. Learn about maintainer account security and registry management.
Dependencies: Do's and Don'ts - Managing Application Dependencies Securely
Learn best practices for managing dependencies in software development, balancing security risks with benefits to team velocity and business value. Discover preventive measures to minimize vulnerabilities.
Demystifying Unreproducible Builds: What, Why, and How
Explore reproducible builds as a defense against software supply chain attacks, understanding their importance and implementation strategies for enhanced security.
Securing Your Software Supply Chain
Explore the current state and future of JavaScript ecosystem security, learn about emerging tools to combat threats, and discover practical strategies to protect your software supply chain.
Navigating Open Source and Open Standards for Better Cybersecurity
Explore the interplay between open source and open standards in cybersecurity, examining their roles in shaping the IT ecosystem and addressing modern software supply chain concerns.
Code Genome - Fingerprinting Code to Build Trustworthy SBOMs
Explore Code Genome, a novel approach to generate and verify Software Bills of Materials (SBOMs) using semantically meaningful fingerprints of code functionality, enhancing software supply chain security.
Ketchup, Mustard, and Relish of Software Supply Chain Security - Panel Discussion
Explore open source standards and tools for enhancing software supply chain security with industry experts. Learn about S2C2F, SLSA, and FRSCA, their benefits, and how to implement them effectively.
OmniBOR: Bringing the Receipts for Supply Chain Security
Explore OmniBOR, a new approach to capture full artifact dependency graphs in software development, enhancing supply chain security and addressing SBOM scanner limitations.
Security Advisory Programs: Creating Transparency in Software Supply Chain
Strategies for implementing transparent security communications programs in software products, addressing customer demands for vulnerability disclosure and open source patching accountability.
Bringing Provenance to Open Source - Lessons from Npm's Sigstore Integration
Explore npm's integration with Sigstore to enhance package provenance, addressing security challenges and implications for the broader open-source ecosystem.
Toto-Ally TUF: Simple Tools for a Secure Software Supply Chain
Learn to secure software supply chains using in-toto and TUF frameworks. Explore their integration, real-world applications, and new open-source tools for enhanced protection against cyber threats.
Verifying the Validity of Crowd-Sourced Results in Open Source Security - The Scorecard GitHub Action and Sigstore
Explore how the Scorecard GitHub Action ensures security in open-source projects, using Sigstore for result integrity and remote attestation in crowd-sourced data validation.