Tied up, shackled and then some: In contrast what you may be thinking after this intro, in this episode Martin and Chris take a closer look at an obscure concept known not only in esoteric circles as the software supply chain (chain being the keyword here). Once only appreciated by the inner circle of a small group of level-eight magicians, this concepts has now entered mainstream and is considered instrumental not only in the area creating and maintaining large scale codebases possibly clocking up a few million lines of code. This especially becomes important when a codebase largely relies on FLOSS components commonly downloaded from the internet. Relying on these components may cause a security issue if not handled with caution as not only the recent xz-utils incident (where possibly a nation-state actor) managed to infiltrate a popular compression library virtually used everywhere. So if you're interested in the security of your builds and applications, this is another episode you don't want to miss.
- Left-pad incident: https://en.wikipedia.org/wiki/Npm_left-pad_incident
Lucene library: https://lucene.apache.org/coreOpen source licenses episode (S01E36): https://archive.org/details/hpr3399SBOMs: https://about.gitlab.com/blog/the-ultimate-guide-to-sbomsXZ Utils backdoor: https://en.wikipedia.org/wiki/XZ_Utils_backdoorOpenSSF's tools (not just SBOMs): https://openssf.org/projectsAutotools: https://www.gnu.org/software/automake/manual/html_node/Autotools-Introduction.htmlSPDX: https://spdx.devCycloneDX: https://cyclonedx.orgvalkey-search: https://github.com/valkey-io/valkey-Thunderbolts: https://www.marvel.com/movies/thunderbolts