zt.dev - Zero Trust and Software Supply Chain Defense

Author’s note: this post’s text was drafted with assistance from Fable 5.

Author’s note: the patches and benchmark code are now published: the harness on the shared-base-experiments branch of fkautz/substrate and the gVisor changes on the shared-base-density branch of fkautz/gvisor.

TLDR: You can rely on the inputs and outputs being repeatable, as long as the tarball captures the data.

Speaking Engagements 2024 KubeCon NA 2024 AI training on kubernetes (no official recording - moved to bigger room) Keynote at 600 person AI hackathon Agentic Zero Trust (Not recorded) Fremont Podcast Trust and Technology SPIFFE (you decide) hosted by Whit…

While contributing to the development of NIST SP 800-204D, a primary objective I pursued was to address a particular deficiency in the realm of software supply chain security.

[FIXED]: GCP Buildpacks Old Compiler Injection Write-Up I would like to personally thank the GCP Buildpacks team for supporting this important project and fixing this issue!

OMB Memorandum M-22-09 This post contains my notes of the entire OMB.

Buildpacks and SBOM integration Buildpacks provide a natural location for integrating SBOMs into developer build environments and CI/CD workflows.

The Problem CVEs play an essential role in announcing vulnerabilities for a given product or library.

Read the Day 1 Write-Up First SBOM-a-Rama, Day 2 Short note These are my notes.

SBOM-a-Rama, Day 1 Short note These are my personal notes.

We generated an SBOM with the SPDX SBOM Generator in a previous post.

The SPDX community created the spdx-sbom-generator that makes it trivial to create SPDX based SBOMs.

We generated an SBOM with cyclonedx-gomod in a previous post.

We can easily create CycloneDX SBOMs for Golang using a new tool from the CycloneDX team.

We needed a software supply chain landscape, and one now exists.

The SBOM Landscape is increasing at a rapid state.