Recent content on zt.dev - Zero Trust and Software Supply Chain Defense
Author’s note: this post’s text was drafted with assistance from Fable 5. TL;DR Seventeen experiments, three layers: the raw Linux primitive, gVisor’s MemoryFile internals, and real runsc on real KVM. All runnable from the published code. Shared-base restore is a measured 5.5x physical-memory flatten (measured by PSS against a paired no-base baseline, N=8, through the runsc CLI).…
Author’s note: the patches and benchmark code are now published: the harness on the shared-base-experiments branch of fkautz/substrate and the gVisor changes on the shared-base-density branch of fkautz/gvisor. A companion post, Every experiment behind the shared-base gVisor memory work, walks each experiment with code, results, and run instructions. This post’s text was drafted with…
TLDR: You can rely on the inputs and outputs being repeatable, as long as the tarball captures the data. (E.g. does yoru tarball capture extended attributes) You cannot rely on the .tar being bit-for-bit repeatable. You can rely on a (lossless) compression algorithm’s input and output being repeatable. You cannot rely on the actual compressed form being repeatable. Author’s Note: There’s a common…
Speaking Engagements 2024 KubeCon NA 2024 AI training on kubernetes (no official recording - moved to bigger room) Keynote at 600 person AI hackathon Agentic Zero Trust (Not recorded) Fremont Podcast Trust and Technology SPIFFE (you decide) hosted by Whitnee Lee Unable to find video Cloud Native Security Con 2024 Guardians of the Dataverse: Securing the AI Supply and Data Chain 2023 Kubernetes…
While contributing to the development of NIST SP 800-204D, a primary objective I pursued was to address a particular deficiency in the realm of software supply chain security. Here’s the critical insight from this endeavor as written in the document: SSC security should also account for discovering and tracking software defects rather than simply mitigating attackers. Pick any widespread…
[FIXED]: GCP Buildpacks Old Compiler Injection Write-Up I would like to personally thank the GCP Buildpacks team for supporting this important project and fixing this issue! This article describes a FIXED vulnerability in GCP Buildpacks that I discovered and collaborated with the GCP team to fix. The buildpack now downloads the most recent stable compiler, effectively fixing the problem. The short…
OMB Memorandum M-22-09 This post contains my notes of the entire OMB. These notes are not a full analysis of the memo but it does include some of my thoughts and opinions as of 30 January 2022. You can read the original at https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf One significant omission is the OMB says nothing about Software or Hardware Supply Chain provenance other than…
Buildpacks and SBOM integration Buildpacks provide a natural location for integrating SBOMs into developer build environments and CI/CD workflows. Author’s note: the goal here isn’t to bash the current state. This is fantastic work and represents a great start, and can evolve into something much more robust. The first iteration should be small in scope and demonstrate opportunity,…
The Problem CVEs play an essential role in announcing vulnerabilities for a given product or library. Recently, we saw the high-impact announcement of CVE-2021-44228 (Log4Shell). Analysts and engineers are inspecting every installation of Java for susceptibility of Log4Shell. However, the presence of a vulnerability does not necessarily mean that a product consuming that library is affected. An…
Read the Day 1 Write-Up First SBOM-a-Rama, Day 2 Short note These are my notes. As such, they may be incomplete and inaccurate at times. If you feel I misrepresented a speaker or a topic, please reach out to me to collaborate on improving this article. I was also trying to participate in some of the chats simultaneously, so I could not take a complete set of notes for the latter part of the event.
SBOM-a-Rama, Day 1 Short note These are my personal notes. As such, they may be incomplete and inaccurate at times. If you feel I misrepresented a speaker or a topic, please reach out to me so that we can collaborate on improving this article. I was also trying to participate in some of the chats simultaneously, so I could not take a complete set of notes for the latter part of the event.
We generated an SBOM with the SPDX SBOM Generator in a previous post. In this post, we perform an initial analysis of the contents of the generated SBOM. The focus of this analysis is on the latest main branch of https://github.com/opensbom-generator/spdx-sbom-generator at 2d55f67b8b1fbcaa722bd22a54c3e406ffe884a9. The SPDX SBOM Generator also supports a rich set of languages: GoMod (go) Cargo…
The SPDX community created the spdx-sbom-generator that makes it trivial to create SPDX based SBOMs. In this post, we will generate an SPDX SBOM. We begin by installing the tool to $GOPATH/bin git clone https://github.com/opensbom-generator/spdx-sbom-generator.git cd spdx-sbom-generator go install cmd/generator For this example, we use the example repo which was used in the NTIA SBOM plug fests:…
We generated an SBOM with cyclonedx-gomod in a previous post. In this post, we perform an initial analysis of the contents of the generated SBOM. The focus of this analysis is on cyclonedx-gomod@v1.0.0. Punchline Run cyclonedx-gomod with the following flags: cyclonedx-gomod app --files --licenses --std Opening <?xml version="1.0" encoding="UTF-8"?> <bom xmlns="http://cyclonedx.org/schema/bom/1.3"…
We can easily create CycloneDX SBOMs for Golang using a new tool from the CycloneDX team. We begin by installing the tool to $GOPATH/bin go install github.com/CycloneDX/cyclonedx-gomod@v1.0.0 For this example, we use the example repo which was used in the NTIA SBOM plug fests: github.com/fkautz/serve. git clone https://github.com/fkautz/serve The cyclonedx-gomod tool provides three subcommands…
We needed a software supply chain landscape, and one now exists. I look forward to seeing this grow over time. Software Supply Chain Landscape Please open an issue or PR at https://github.com/fkautz/zt.dev if you would like to contribute a project or fix a bug. Thank you and enjoy!
The SBOM Landscape is increasing at a rapid state. This is an incomplete list of SBOM and Supply Chain projects and how to find their respective communities. If you would like to contribute to this list, please open an issue or pull request at https://github.com/fkautz/zt.dev Requirements / Policy Working Groups NTIA SBOM Resource Page Website: https://ntia.gov/SBOM Contact: Allan.Friedman 👋…
This site was created as a place to publish information about Zero Trust and Software Supply Chain Defense. About Frederick LinkedIn Frederick Kautz is a distinguished leader in open-source and cloud-native communities, with over 10 years of kubernetes and docker experience, extensive expertise in software supply chain security, Zero Trust, and networking. He co-authored the influential NIST…
2024-04-29 Tarballs are Both Reproducible and Non-Reproducible! 2023-11-12 On the Importance of Tracking Software Dependencies 2022-02-03 GCP Buildpacks Old Compiler Injection Write-Up [Fixed] 2022-01-10 Buildpacks and SBOM Integration Opportunities 2021-12-19 What is VEX? It's the Vulnerability Exploitability eXchange! 2021-12-16 SBOM-A-Rama (2021) Day 2 Write Up 2021-12-16 SBOM-A-Rama (2021) Day…
2022-01-31 Overview of the OMB Memorandum MB-22-09: Zero Trust Memo