Securing the Open Source Software Supply Chain
Explore the critical topic of securing the open source software supply chain in this 30-minute PyCon US talk. Delve into the challenges of ensuring security in open source software, where anyone can publish libraries and contribute to projects. Learn about new tools and best practices that can be implemented immediately to enhance the security of your software supply chain and build trust in the ecosystem. Discover how different security measures protect against various vulnerabilities in the software supply chain. Gain insights into upcoming improvements and potential advancements in the open-source ecosystem. Topics covered include ephemeral environments, fuzzing, community advisory databases, vulnerability auditing software, sigstore for signing and verifying software, SLSA (Supply chain Levels for Software Artifacts) framework, in-toto standard, and Allstar for enforcing security policies. Also, learn about recent initiatives like 2FA requirements and hardware key giveaways, as well as predictions for future developments in open source security. Read more