{"guid":"d794559e-f460-5879-8567-35b00f7d2cca","title":"Reproducible Builds zur Absicherung von Open-Source-Supply-Chains mit Zero Trust","subtitle":null,"slug":"ds26-633-reproducible-builds-zur-absicherung-von-open-source-supply-chains-mit-zero-trust","link":"https://talks.datenspuren.de/ds26/talk/B9VSYR/","description":"Maximaler Zero Trust für Open-Source-Projekte: Schutz vor Innentäterinnen und State Level Actor\n\nElaborierte Supply-Chain-Attacken durch State Level Actor gehören inzwischen für einige Open-Source-Projekte schon fast zum Alltag, der Angriff über die xzlib auf OpenSSH ist hier nur ein aktuelles Beispiel. \nDeshalb setzen viele - insbesondere sicherheitskritische - Open-Source-Projekte auf Reproducible Builds. Dabei werden nicht mehr einfach Binaries auf einer Downloadseite mit einer GnuPG-Signatur geschützt, sondern u.a. durch mehrere unabhängige Build Pipelines und hermetische Builds auch Angriffe durch Innentäter massiv erschwert. Durch Reproducible Builds kann die gesamte Supply Chain eines Projektes massiv abgesichert werden. \nFür Nutzer der Software ist dann nicht nur die Integrität des ISO-Images gesichert, sondern auch die Herkunft eines installierten Binaries nahezu zweifelsfrei nachvollziehbar und wie Wahrscheinlichkeit dass ein Innentäter das Binary erfolgreich manipuliert hat nahezu Null. \n\nIch stelle in diesem Vortrag die Maßnahmen vor, die nach den OpenSSF SLSA (Supply-chain Levels for Software Artifacts) empfohlen werden und auf welche Sicherheitsziele sie wie konkret einzahlen.  \nDabei gehe ich insbesondere auf die Erfahrungen von Open-Source-Projekten wie NetBSD, Debian, The Tor Browser, NixOS oder Tails ein.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"deu","persons":["Stefan Schumacher"],"view_count":0,"promoted":false,"date":"2026-09-19T19:00:00.000+02:00","release_date":"2026-09-19T00:00:00.000+02:00","updated_at":"2026-09-19T23:17:32.646+02:00","tags":["B9VSYR","2026","ds26","Technik","Kleiner Saal","ds26-deu","Day 2"],"length":2848,"duration":2848,"thumb_url":"https://static.media.ccc.de/media/events/datenspuren/2026/633-d794559e-f460-5879-8567-35b00f7d2cca.jpg","poster_url":"https://static.media.ccc.de/media/events/datenspuren/2026/633-d794559e-f460-5879-8567-35b00f7d2cca_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/datenspuren/2026/633-d794559e-f460-5879-8567-35b00f7d2cca.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/datenspuren/2026/633-d794559e-f460-5879-8567-35b00f7d2cca.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/ds26-633-reproducible-builds-zur-absicherung-von-open-source-supply-chains-mit-zero-trust","url":"https://api.media.ccc.de/public/events/d794559e-f460-5879-8567-35b00f7d2cca","conference_title":"Datenspuren 2026","conference_url":"https://api.media.ccc.de/public/conferences/DS2026","related":[],"recordings":[{"length":2848,"mime_type":"video/mp4","language":"deu","filename":"ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-19T22:20:41.751+02:00","label":"deu 1080p","size":203,"recording_url":"https://cdn.media.ccc.de/events/datenspuren/2026/h264-hd/ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_hd.mp4","url":"https://api.media.ccc.de/public/recordings/104970","event_url":"https://api.media.ccc.de/public/events/d794559e-f460-5879-8567-35b00f7d2cca","conference_url":"https://api.media.ccc.de/public/conferences/DS2026"},{"length":2848,"mime_type":"video/webm;codecs=av01","language":"deu","filename":"ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_av1-hd.webm","state":"new","folder":"av1-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-19T22:27:29.499+02:00","label":"deu 1080p","size":235,"recording_url":"https://cdn.media.ccc.de/events/datenspuren/2026/av1-hd/ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_av1-hd.webm","url":"https://api.media.ccc.de/public/recordings/104975","event_url":"https://api.media.ccc.de/public/events/d794559e-f460-5879-8567-35b00f7d2cca","conference_url":"https://api.media.ccc.de/public/conferences/DS2026"},{"length":2848,"mime_type":"video/mp4","language":"deu","filename":"ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-19T22:27:34.553+02:00","label":"deu 576p","size":87,"recording_url":"https://cdn.media.ccc.de/events/datenspuren/2026/h264-sd/ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_sd.mp4","url":"https://api.media.ccc.de/public/recordings/104976","event_url":"https://api.media.ccc.de/public/events/d794559e-f460-5879-8567-35b00f7d2cca","conference_url":"https://api.media.ccc.de/public/conferences/DS2026"},{"length":2848,"mime_type":"audio/mpeg","language":"deu","filename":"ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-19T22:28:06.353+02:00","label":"deu","size":44,"recording_url":"https://cdn.media.ccc.de/events/datenspuren/2026/mp3/ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/104980","event_url":"https://api.media.ccc.de/public/events/d794559e-f460-5879-8567-35b00f7d2cca","conference_url":"https://api.media.ccc.de/public/conferences/DS2026"},{"length":2848,"mime_type":"audio/opus","language":"deu","filename":"ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-19T22:29:30.903+02:00","label":"deu","size":27,"recording_url":"https://cdn.media.ccc.de/events/datenspuren/2026/opus/ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_opus.opus","url":"https://api.media.ccc.de/public/recordings/104985","event_url":"https://api.media.ccc.de/public/events/d794559e-f460-5879-8567-35b00f7d2cca","conference_url":"https://api.media.ccc.de/public/conferences/DS2026"},{"length":2848,"mime_type":"video/webm","language":"deu","filename":"ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-19T23:13:35.488+02:00","label":"deu 1080p","size":252,"recording_url":"https://cdn.media.ccc.de/events/datenspuren/2026/webm-hd/ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/105002","event_url":"https://api.media.ccc.de/public/events/d794559e-f460-5879-8567-35b00f7d2cca","conference_url":"https://api.media.ccc.de/public/conferences/DS2026"},{"length":2848,"mime_type":"video/webm","language":"deu","filename":"ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-19T23:17:32.593+02:00","label":"deu 576p","size":107,"recording_url":"https://cdn.media.ccc.de/events/datenspuren/2026/webm-sd/ds26-633-deu-Reproducible_Builds_zur_Absicherung_von_Open-Source-Supply-Chains_mit_Zero_Trust_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/105003","event_url":"https://api.media.ccc.de/public/events/d794559e-f460-5879-8567-35b00f7d2cca","conference_url":"https://api.media.ccc.de/public/conferences/DS2026"}]}