OpenSSF Community Day India 2025

The security of a Linux distribution depends on the integrity of its entire software supply chain, from source code to compiled binaries. With rising threats like dependency poisoning, malicious injections, and package manager compromises, securing the supply chain is no longer optional.

This talk will present a practical framework for strengthening Linux supply chain security.

We'll cover:
1. Verifying source authenticity with cryptographic signing and reproducible builds.
2. Automating SBOM generation to track dependencies and prevent supply chain attacks.
3. Enforcing integrity using open-source tools like Sigstore (Cosign, Rekor), in-toto, and OpenSCAP.
4. Analyzing real-world attack scenarios and how to mitigate them effectively.

By the end, attendees will gain actionable strategies to prevent tampering, detect anomalies early, and ensure trusted software delivery across open-source Linux distributions.