With our complete software development process becoming more complex we also got a lot more security problems to deal with. What starts with code and ends with releasing/deploying software is also being referred at as the software supply chain.
Over the last years we've seen some big security incidents tied to the software supply chain and the software industry acknowledged there was a need for action. And today there is a lot to choose from, but what will be the most effective things to do? We'll start out with a GitHub repository that contains a .NET application and work our way through in securing the supply chain by covering the following subjects:
- Defining the software supply-chain security risks
- Git commit signing
- Reproducible Builds
- Understanding used 3rd party libraries
- Creating Software-Bill of Materials (SBOM)
- Google SLSA
- Signing code and artifacts
- My supply chain got hacked, now what?
A side from having access to GitHub you also need to bring your own .NET development machine to participate in this workshop.