Lightning Talk: Repurposed Purpose: Using Git's DAG for Supply Chain Artifact Resolution- Aeva Black
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2022-05-19

Lightning Talk: Repurposed Purpose: Using Git's DAG for Supply Chain Artifact Resolution - Aeva Black, Microsoft

What if we could know the complete and reproducible artifact tree for every binary executable, shared object, container, &etc – including all its dependencies – and you could efficiently cross-reference that against a database of known vulnerabilities? If you had had that information, could you have remediated Log4Shell faster? Might it even help open source maintainers identify at-risk dependencies sooner? If you're thinking, "this sounds too good to be true - what's it going to cost?", then we really hope you’ll join us because we believe this should be an automatic part of open source build tools. In this talk, Aeva and Ed will share why they're so excited about GitBOM and explain what it is (hint: it's not git and it's not an SBOM). If the demo gods are willing, they will show you how you can generate a GitBOM with a simple command-line tool, and explain why you won't have to.