Software supply chain security

Re:Software supply chain security by trishankdatadog on Friday September 04, 2020 @12:07AM (#24371628)

Don't miss how we used TUF [1] and in-toto [2] to build compromise-resilient CI/CD (the first in the industry AFAICT) for the Datadog Agent integrations [3][4] that detects attacks anywhere between our developers and end-users

[1] https://theupdateframework.io/

[2] https://in-toto.io/

[3] https://www.youtube.com/watch?v=9hCiHr1f0zM

[4] https://dtdg.co/integrations-tuf-in-toto

[ Parent | on HN ]

Re:Software supply chain security by p932 on Friday September 04, 2020 @05:42AM (#24373371)

How this pattern/toolset protect against supply chain compromises of the dependencies used to build the "Datadog Agent" itself?

[ Parent | on HN ]

Re:Software supply chain security by trishankdatadog on Friday September 04, 2020 @11:18AM (#24375686)

Apply pattern/toolset recursively. Software supply chain problems largely eventually solved this way.

[ Parent | on HN ]

Re:Software supply chain security by p932 on Friday September 04, 2020 @12:47PM (#24376609)

Is there any initiative in this direction towards applying this pattern on big dependency management tools (e.g maven, pip, npm)?

[ Parent | on HN ]

Re:Software supply chain security by trishankdatadog on Saturday September 05, 2020 @08:04PM (#24387814)

Yes, please see PEP 458: https://www.python.org/dev/peps/pep-0458/

[ Parent | on HN ]