July 2022 Summaries

The text discusses the issues of having a highly available PowerShell module repository that can withstand outages like the one described. It introduces Cloudsmith as a solution to this problem, providing a way to create a NuGet repository and configure it in a local PowerShell console. The process involves creating an organization, repository, and API key, then configuring the repository locally using variables and credentials. The text also covers pushing and installing modules from the repository, as well as setting up a Cloudsmith Upstream with the PowerShell Gallery for easy access to modules without needing to push them first.

Syft, Grype, Cosign, and Cloudsmith are tools that can improve supply chain security workflows by enhancing visibility and preventing disasters like Log4J. Software Bill of Materials (SBOMs) is a list of all components in a software product, which can help identify vulnerabilities and ensure trust in the software supply chain. Sift and Grype are tools used to generate SBOMs, while Cosign and Cloudsmith provide integration with these tools to host and analyze SBOMs. The future of SBOMs involves making them actionable, integrating tooling into CI/CD workflows, and providing interfaces for users to bring in custom information. As the community matures, we can expect to see more seamless integration of SBOMs into the software ecosystem.

SBOMs (Software Bill of Materials) are a crucial tool in ensuring the security of software products, allowing organizations to analyze vulnerabilities and remediate them. Vulnerabilities can be rated using CVSS (Common Vulnerability Scoring System) and EPSS (Exploit Prediction Scoring System), with VEX (Vulnerability Exploitability Exchange) providing a way for software creators to communicate exploitability information. Tools like Dependency-Track, Grype, and DaggerBoard help analyze SBOMs for vulnerabilities, while Cloudsmith's quarantine feature can temporarily block downloads of compromised artifacts. Effective remediation workflows involve notifying internal owners, updating artifacts, and alerting users, as well as considering disclosure requirements for customers and third-party users. Integrating SBOM tooling into workflows is essential for securing software products, even if not all ecosystems are fully supported yet.

An accurate Software Bill of Materials (SBOM) provides critical information about the components, licenses, and dependencies in a software product, enabling users to evaluate its risk and take proactive measures to secure their systems. SBOMs can be generated at various stages of the build lifecycle, including source code, build-time, container images, and runtime. The NTIA recommends generating an SBOM for every new release of a component, while open-source tooling like Sigstore, CycloneDX, Syft, Grype, and Trivy help automate SBOM workflows and integrate them into software pipelines. Cloudsmith's artifact repository integrates with Cosign to host SBOMs in an OCI registry. Runtime tools capture the exact libraries used by the application, providing a more detailed view of the software's dependencies. Validating SBOMs is essential to ensure they adhere to format specs, while verifying SBOMs involves checking cryptographic signatures. The Vulnerability Exploitability eXchange (VEX) provides vulnerability status information for components in an SBOM, complementing SBOMs and offering remediation steps if necessary. Despite advances in SBOM tooling and adoption, important questions remain, such as the completeness of SBOMs and the accuracy of tools at different stages of the build lifecycle. Initiatives to improve SBOM tooling and training are underway, aiming to make useful and accurate SBOMs available for all ecosystems.