Watch and track your favorite playlist.
Curated by: The Linux Foundation (287 videos)
Don't miss out! Join us at the next Open Source Summit in Seoul, South Korea (November 4-5). Join us at the premier vendor-neutral open source conference, where developers and technologists come together to collaborate, share knowledge, and explore the latest innovations and advancements in open source technology. Learn more at https://events.linuxfoundation.org/ ESSTRA: A Software Suite To Enhance Software Transparency and Traceability in Software Supply Chain - Takuya Namae, Sony Group Corporation When you use OSS, do you want to know which source files are compiled and included in the binaries? Project ESSTRA (https://github.com/sony/esstra) is a tool that collects a list of source files while compiling your software and embeds the data into the binaries. Recently, the importance of using SBOMs has been increasing, and there is a growing demand for improved transparency and traceability in the software supply chain from the perspectives of vulnerability management and OSS license compliance. However, it is difficult to trace the details of which files are included in the binaries used in your product or service, and which OSS licenses to comply with based on this data. To solve this issue, Sony has developed ESSTRA. It is available now as open source itself, and includes both a GCC plugin to record source files during a build and embed it into resulting binaries, as well as a tool to manage the information. ESSTRA is already supported by Binary Analysis Next Generation (BANG) tool. Attendees of this session will learn how to use ESSTRA and take the first steps to improve the transparency and traceability of your project's software.