February 2022 Summaries

The US Government has responded to the Log4Shell vulnerability by convening government and private sector stakeholders to discuss how to improve the security of open-source software. This includes efforts to increase automation, education, collaboration, and support for open-source maintainers. The Open Source Security Foundation (OpenSSF) is also playing a key role in improving OSS security through initiatives such as the Alpha Omega Project and other projects that aim to provide visibility into the "ingredients" of software through Software Bill of Materials (SBOMs). To secure their own software pipelines, developers can use tools like Sigstore, integrate with SBOM formats, and bring packages into private repositories. Package management is also crucial to securing supply chains, and Cloudsmith is a hosted package management service that provides robust security features and policies to prove its packages are trustworthy. Overall, the security of open-source software is a national security concern, and efforts to secure OSS are underway to address this threat.

Continuous Packaging (CP) is a crucial component of secure software development processes, providing a glue layer between CI and CD pipelines by storing and delivering packages securely and efficiently across all package formats and languages. The lack of provenance in traditional software supply chains makes them vulnerable to attacks, but CP provides a verifiable "Single Source of Truth" for all packages, images, or artifacts consumed or produced during CI processes. It also offers isolation, protection from vulnerabilities, and license management, allowing teams to control package availability, protect against security threats, and manage licenses effectively. By implementing CP, teams can accelerate their software development pipelines while promoting collaboration and providing a uniform experience for distributed teams. Cloudsmith's Package Delivery Network (PDN) is an example of a cloud-native tool that provides universal package support, controls, and availability, making it an ideal solution for introducing CP into CI/CD pipelines.

The Log4Shell vulnerability is a critical security risk that can lead to Remote Code Execution (RCE) and data exfiltration, affecting log4j versions below 2.17.0 due to its widespread use across many enterprises, projects, and organizations. The vulnerability exploits the Java Naming and Directory Interface (JDNI), allowing attackers to execute arbitrary code in the context of the application's environment. Mitigation involves upgrading dependencies to at least version 2.17.0, setting system properties or environment variables to prevent JNDI lookups, and disabling certain protocols. Cloudsmith provides tools and resources to help identify affected packages, automate scripting, and block installations of impacted versions.

The Cloudsmith team has announced significant improvements to their support for Dart packages, building on the company's mission to be the universal package repository. The updates include advanced authentication for third-party repositories, allowing users to securely publish and pull packages from private repositories like Cloudsmith. This enhancement is particularly notable in its ability to expand the use of private repositories beyond pub.dev, providing more accessible and secure hosting options for Dart packages. With these improvements, users can now easily publish and install packages using native Dart tooling, streamlining their package management workflow.