OpenSSF Community Day Japan 2025

As open-source software adoption accelerates, so do the threats targeting its supply chain. But what does it really mean to secure your software supply chain? And how do concepts like SLSA (Supply Chain Levels for Software Artifacts), SBOM (Software Bill of Materials), and tools like Sigstore fit into the picture?

In this session, I’ll cut through the noise to demystify the fundamentals of software supply chain security. We’ll explore these frameworks and tools in depth, understand how they work together, and provide a clear practical guide to building stronger, more resilient pipelines. I’ll also highlight real-world supply chain threats from dependency confusion to insecure deployments and show how open-source tools can help you detect, prevent, and respond to these risks effectively.