August 2022 Summaries

In a follow-up to their previous Linux Foundation webinar, the discussion continues with an update on progress in the software supply chain security efforts. The OSS (Open Source Software) community is making strides in standardizing and securing open-source software, which can be adopted by everyone. Several tooling options are now available to support this journey, providing a foundation for improved security and trust in the software supply chain. Experts from Red Hat, Cloudsmith, and Sigstore share their insights and expertise to help navigate this critical area of development.

The text discusses the importance of visibility in a software supply chain to ensure the safety and security of developed software. It highlights the need for audit logs, Software Bill of Materials (SBOMs), automation, and package management to bring transparency into the build process. The article then dives deeper into specific strategies such as automated build steps, versioning software, pinning dependencies, automated dependency updates, scorecards, signing artifacts, generating SBOMs, and provenance of built artifacts. These measures can help answer questions like what is installed on a system, who wrote the code, and how to trace builds from source to deployment. Additionally, observability tools can provide insights into unusual behavior, identify vulnerabilities, and detect potential security incidents, ultimately securing the software supply chain.

Ruby is an open source, interpreted, general purpose programming language that was developed by Yukihiro "Matz" Matsumoto in 1995. It has been around for almost three decades and maintains popularity as one of the preferred languages for web development, static site generation, DevOps, and automation. Ruby on Rails combines Ruby with a web application development framework called Rails, which includes a great deal of boilerplate code and standardized conventions for tasks like setting up a web server and securing against common web attacks. This combination is utilized in some of the most popular sites on the Internet. Ruby can be packaged in shareable units of code called Ruby Gems, which are reusable programs and libraries that exist as gems, and the package manager for handling their structure, packaging, download, and installation is also called RubyGems. Hosting a private repository for these gems is necessary when an organization has private code that cannot be shared publicly, and Cloudsmith is a cloud-native SaaS artifact management solution that can host multiple formats in the same repository, with support for 28+ package formats, including gems. Additionally, Cloudsmith offers a 14-day free trial and now supports Ruby Upstreams, which allows developers to leverage the power of RubyGems.org in their own private highly-available Cloudsmith repositories.