Thread by @nnja

Now on at #PyconUS2022 is ⁦@di_codes⁩ talking about Securing the Open Source Supply Chain.

ABC’s of software supply chain
Artifact: ie a file on PyPi
Attestation: evidence or proof that something happened
Advisory: public disclosure, CVEs
Build: build process produces artifacts
Certificate: easier now, with LetsEncrypt
Digest: hash digest, not reversible

Ephemeral: used once and thrown away (in context of cryptographic keys and signing)
F: Fuzzing (vary inputs)
G: Google
Hardware keys: best path for 2FA
Identity: unique and verifiable
Joe Biden: Executive Order
Key: verify signature by keyholder
Lockfile: pipfile.lock

Money: software costs money to make, especially free and open source. Elevating security chain won’t come for free. Orgs need to commit money
Non-forgeable: content of attestation can’t be modified
Open ID Connect: verify and exchange identities

Provenance: history of an artifact
Policy: describe expectations
Remediation: fix what’s wrong, ideally easy or automatic
Signature: proof keyholder was in possession of key

Transparency Log: public immutable record of signs of attestation
Vulnerability: bug in software with security consequences

Use pip-audit for a run down of vulnerabilities in your project.

Run it on your laptop now to see if you have any installed vulnerabilities.

pypi.org/project/pip-au…

SIGstore: new way to think about signatures, identity and trust. Built on top of oauth.

Keys are ephemeral.

Every signature is stored in a transparency log.

New sigstore tool on PyPi is working towards a 1.0 release.

sigstore.dev/undefined/

pypi.org/project/sigsto…

Tools that can help:
SLSA (salsa!) security framework
in toto: ensures integrity of an artifact

slsa.dev
in-toto.io

Announcement:
- Coming soon to PyPI: voluntary 2FA for collaborators!!
- 2FA mandate for critical projects (Top 1% of projects)
- Giving away 4K Google Titan keys to maintainers of critical projects (soon!)
- Credentials publication via OIDC
- PEP480

Open SSF - new multi organization non profit part of Linux Foundation working on supply chain security. Members include Google (and Microsoft!)

openssf.org