►
From YouTube: Closing the Supply Chain Security Loop with Rust & Pyrsia - Stephen Chin & Joel Marcey
Description
For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/
Closing the Supply Chain Security Loop with Rust & Pyrsia - Stephen Chin, JFrog & Joel Marcey, Rust Foundation
Rust is the most loved and most wanted programming language today, and the community has nearly quadrupled in the last two years to 2.2 million. With over 85,000 packages built by thousands of contributors across world, Rust is the definition of open and inclusive. We are going to talk about one project that is leveraging Rust to enhance supply chain security for open source projects just like the ones that make Rust Rust. Pyrsia will address one of the security challenges we all face: using secure packages in our development. Join us for an informative and interactive session on Rust, Pyrsia, and how their communities are working together to secure the software supply chain.
A
B
Yeah
I
know
we
test
this
over
lunch
and
thanks
very
much
for
our
lunchtime
audience.
It
was
helping
us
out
making
sure
that
the
setup
worked
and
getting
the
test
working.
So
while
we're
while
we're
getting
Joel
set
up,
I
know,
I
gave
the
earlier
a
talk
on
on
Persia
just
to
introduce
it
and
sudentra
also
gave
a
few
comments.
But
this
is
a
great
time
to
ask
questions
that
I
can
answer
for
folks
about
about
the
project
or
the
goals
or
what
we're
trying
to
do.
B
All
what
I'll
go
into
in
this
presentation
once
we
get
you
all
on,
is
we'll
talk
a
bit
about
the
rust
language,
why
we
chose
the
rust
language
as
the
the
language
of
choice
to
implement
Persia
and
also
what
we're
doing
to
to
secure
different
different
language.
Ecosystems,
so
I
know
I'm
putting
you
guys
on
the
spot
now,
but
but
anybody
have
a
have
a
burning,
a
burning,
oh
question:
I'm.
C
B
Okay,
yeah
yeah.
That's
that's
a
really
good
question,
so
I'm
gonna,
I'm
gonna
answer
that
question.
While
I
flip
the
slide,
so
you
don't
see
my
desktop.
So
one
of
the
general
strategies
which
which
we're
doing
on
the
project
is
we're
going
one
language
ecosystem
at
a
time
to
make
sure
we
can
have
a
really
tight
integration
with
that
language
and
make
like
create
a
good
developer
experience
right.
B
So
as
a
as
a
user
like
as
a
developer
or
somebody
like
hooking
up
CI
CD
systems
to
our
tool
chain,
you
you
want
it
to
integrate
seamlessly,
for
example,
with
a
Java
ecosystem
with
Maven
and
Gradle.
You
wanted
to
integrate
and
in
the
the
cloud
native
ecosystem
really
well
with
Docker
and
Cube
control
and
all
the
kubernetes
tools,
and
what
we're
trying
to
do
is
make
sure
that
for
each
ecosystem,
we
we
make
it
a
very
tight,
seamless,
easy
integration
and
we
we
are
going
down
the
rabbit
Hall.
B
The
dependency
rabbit
Hall
in
terms
of
are
our
own
builds
our
builds
from
source
to
to
build
as
much
as
we
can
building
everything
from
Source
we're
not
currently
going
all
the
way
up
to
like
compilers
and
everything
up
the
tool
chain
to
completely
build
the
whole
world.
But,
as
we
expand
out
like
the
all
the
things
which
we're
building
any
dependencies,
we
can
pull
from.
Our
own
network,
which
are
also
built
from
Source,
will
will
also
be
leveraging
and
using.
A
B
D
B
Okay
cool
so
glad
to
be
able
to
co-present
with
you
Joel,
even
if
it's
virtually
I
think
this
is.
This
is
the
new
normal
right
we
can.
We
can
co-present
even
from
across
the
world
and
or
across
the
country
and
I
think
when
you,
when
you
look
at
Percy
as
a
project,
as
I
mentioned,
we've
implemented
Persia
entirely
in
Rust,
so
it's
a
new
code
base
built
from
the
ground
up
and
one
of
the
the
questions
when
we
started
the
project
was
what
like
like.
Why
rest
right?
B
A
B
B
We
want
our
project
to
be
as
free
from
accidental
bugs
from
intentional
bugs
from
like
to
be
easy
to
verify,
to
be
easy
to
to
make
sure
that
the
code
base
is,
you
know,
reasonably
secure,
and
there
are
a
lot
of
attributes
of
the
rest
programming
language
which
are
really
really
great
for
this.
So
let's,
let's
talk
a
bit
about
the
rust
programming
language
itself,
so
you
want
to
give.
D
Us
the
highlights
Joel,
yeah,
sure
yeah,
thanks
again
Steve,
so
Steve
started
with
a
bit
of
a
teaser
showing
how
Percy
has
written
rust.
That
allows
me
to
give
a
bit
of
a
preamble
about
Russ
before
he
dives
into
more
details
about
Percy
itself,
the
open
source
supply
chain
and,
potentially,
how
you
can
get
involved
rust
is
in
its
seventh
year.
A
stack
Overflow
is
most
loved
language
now
being
a
love.
Language
is
only
part
of
the
equation
right.
D
You
could
be
really
small
language
and
really
loved,
but
it's
really
important
to
know
that
it's
really
growing
in
the
number
of
people,
a
number
of
developers
that
actually
want
to
use
it.
So
you
have
this
curve
of
love
language
and
developers
wanting
to
use
it.
So
Russ
is
actually
becoming
a
formidable
choice
in
the
developer
community,
but
here's
how
you
know
that
rust
has
made
it
into
as
a
programming
language.
If
Linus
Torvalds
is
blessing,
the
Linux
kernel
to
have
you
as
a
supported
option.
D
That's
that's
probably
a
good
thing.
It's
taking
effort
to
get
the
support,
but
I
think
some
facet
of
it
should
be
there
in
Linux
6.1,
which
is
scheduled
to
be
available
at
the
end
of
this
year,
and
this
is
real
benefit
right
because
it
can
expand
the
developer
pool
for
those
who
want
to
contribute
to
Linux.
It
allows
the
it
allows
rust
to
be
considered
for
new
features
or
potential
rewrites
and
those
sorts
of
things.
So
it's
actually
a
pretty
big
deal
and
it
shows
that
Russ
is
actually
here
to
stay.
Yeah.
B
So
I
was
I
was
in
the
notes
for
open
source
Summit
North
America,
where
Linus
talked
a
bit
about
like
their
friends
to
further
Embrace
Russ,
make
it
a
great
choice
for
writing.
Secure
kernel
extensions,
but
also
like
looking
at
other
ways
they
can
integrate.
It
I
think
that
that
same
sort
of
calculation,
which
the
Linux
project
is
making
a
lot
of
companies
are
making
as
well.
B
So
one
of
the
things
which
I
think
you
you
know
jfrog,
we
run
artifactory,
it's
the
it's
package
manager
by
the
top
companies
and
we're
increasingly
seeing
our
customers
for
for
better
and
more
tightly
integrated
rust
support
because
they
have
teams
in
their
company
which
are
doing
net
new
developments
on
Rust.
Actually
I
was
just
in
the
in
the
rust
Russ
London
Meetup
I
was
in
London
last
week.
B
Thanks
so
I
was
just
in
I
was
just
in
London
and
I
was
hanging
out
with
some
folks
over
beer.
So
this
is
this:
is
beer
NDA,
but
I
was
I
was
chatting
with
a
with
a
certain
company
which
writes
Salesforce
software
and
one
of
the
guys
there
was
working
on
a
on
a
project
to
completely
rewrite
everything
in
Rust
and
they're
they're,
a
big
Java
shop,
so
I
think
that
there's
a
lot
of
initiatives.
B
D
So
Steve
talked
about
this
a
little
bit
when
you
mentioned
Percy
has
written
in
rest,
but
let
me
give
you
a
a
like
a
hundred
thousand
foot
overview
about
what
Russ
actually
is.
This
isn't
a
full-blown
rust
talk
and
there's
much
more.
That
could
be
said,
but
at
the
high
level
right
rest
consists
of
a
programming
language,
libraries
and
a
worldwide
ecosystem,
and
the
language
itself
can
create
programs
that
are
really
fast
memory.
Efficient
memory,
safe,
there's,
there's
no
run
time.
D
There's
no
garbage
collector
can
power
both
performance,
critical
Services,
run
on
embedded
devices
on
the
ecosystem
side.
You
can
use
rust
with
things
like
webassembly
rust
has
good
documentation,
a
friendly
compiler
with
useful
error
messages,
and
actually
that's
actually
a
really
key
selling
point
to
rest
for
compiled
languages.
Sometimes
when
you're,
when
you're
programming
and
you're
making
mistakes,
the
compiler
isn't
always
very
helpful.
In
this
case,
the
compiler
actually
almost
fixes
your
problem
for
you,
it's
actually
really
good.
So
it's
very
productive.
D
It's
very
pretty
makes
you
very
productive
and
there's
top-notch
tooling,
including
an
integrated
package
manager
and
build
tool,
which
is
called
cargo
I
want
to
focus
on
memory
safety.
Just
for
a
moment
here,
programs,
access
memory
and,
depending
on
what
programming
language
you
use
to
write
the
code,
there
can
be
various
ways
to
manage
the
allocation
and
use
of
that
memory.
Sometimes
the
programmer
has
to
do
it
manually.
Sometimes
the
language
compiler
do
it
for
you.
D
However,
it
is
done
if
it's
managed
wrong
really
bad
things
can
happen
so
accessing
memory
that
is
not
yours
or
part
of
the
running
program
can
cause
massive
security
vulnerabilities.
Since
that
memory
can
contain
sensitive
information
or
be
used
to
initiate
an
exploitation
attack,
it
can
even
be
a
common
cause
of
zero
data
tax.
It
said
it
said
that
an
estimated
70
percent
of
security
vulnerabilities
are
due
to
memory
safety
issues.
So
Russ
was
designed
to
be
Memory
safely,
a
memory
safe
Language
by
default
through
a
concept.
D
What
they
call
ownership
I
won't
get
into
the
details
of
exactly
what
ownership
is,
but
basically
it
provides
a
set
of
rules
and
guarantees
for
how
memory
is
managed
such
that
your
program
won't
even
compile
if
those
rules
are
violated.
So
if
you
have
a
program
and
it
doesn't
compile,
it
won't
create
an
executable.
If
you
don't
have
an
executable,
it
obviously
can't
run,
and
so
you
avoid
memory
problems
in
that
respect.
So
this
essentially
eliminates
the
possibility
of
memory
issues
at
runtime.
D
There
is
a
construct
in
Rust
called
unsafe,
which
is
very
much
opt-in
and
very
much
explicit.
That
gives
you
kind
of
superpowers
to
de-reference
pointers
and
do
all
these
sorts
of
things
I
won't
get
into
that
too
much.
But
just
know
that
generally
in
the
99
use
case
of
rust,
you
won't
be
using
unsafe
and
you
won't
be
running
into
any
issues
and,
in
fact,
even
with
unsafe.
The
compiler
actually
helps
you
out
a
bit
all
this
is
to
say
that
a
rust
developer
and
those
in
the
community
that
use
rest
of
their
applications.
D
This
allows
a
huge
of
applications
to
be
written
via
the
built-ins
that
rust
provides
by
default
and
those
third-party
up
those
third-party
packages-
and
a
really
key
thing
to
note
is
everything-
is
open.
Source
is
a
core
tenant
of
the
rust
project
and
everything's
done
on
GitHub,
there's
a
bunch
of
community
channels
on
zulup
and
Discord,
and
so
everything's
really
done
out
in
the
open.
So
in
those
in
in
that
way,
it's
not
hard
to
understand
why
Russ
is
actually
becoming
so
loved
and
becoming
so
popular.
B
Yeah,
so
for
for
Persia,
we
actually
use
a
bunch
of
rust,
open
source
libraries,
so
we
use
P2P
Libs.
So
that's
the
underlying
peer-to-peer
infrastructure
library
that
sits
below
ipfs.
We
don't
directly
use
ipfs,
but
we
use
some
of
the
peer-to-peer
constructs
to
exchange
files,
build
the
network
and
exchange
artifacts
over
the
Persia
Network,
and
we
also
use
a
consensus
algorithm
based
upon
the
left,
bft
libraries.
So
again
like
we,
we
do
our
own
immutable
transaction
Ledger.
B
We
we
have
our
own
design
for
for
how
all
that
information
is,
is
stored
and
how
the
blocks
are
constructed.
But
it's
nice
that
we're
able
to
take
advantage
of
a
bunch
of
libraries
and
different
open
source
projects
which
are
written
entirely
in
Rust,
which
give
the
same
sort
of
security
guarantees
to
their
users
into
the
downstream
projects
and
the
ecosystem.
Around
rust
has
been
really
really
strong
for
us
to
start
a
relatively
new
project
like
this,
but
then
have
all
of
the
core
for
infrastructure
and
features
which
we
need
to
develop
quickly.
B
D
D
I
work
for
the
rest
foundation
and
it's
the
foundation's
mission
to
support
the
Russ
language,
its
maintainers
and
its
ecosystem.
And
what
that
means
in
practice
is
that
next
slide
yeah.
What
that
means
in
practice
is
the
foundation
helps
provide
infrastructure
to
support
the
rust
project,
maintains
non-technical
aspects
of
rust,
like
it's
trademarks,
legal
agreements
and
create
some
manages
programs
to
support
the
entire
community
and
help
grow
the
use
of
the
language
as
we
as
we
like
to
say,
we
got
the
boring,
boring
stuff
covered.
B
Yeah
and
I
think
this
is.
This
is
also
another
really
important
consideration
for
Technologies
in
general.
Is
you
know,
I
think
we
all
do
this
when
you're
looking
for
a
new
technology
to
adopt,
you
want
to
make
sure
it's
well
supported
by
like,
like
a
vendor,
neutral
Consortium,
so
you
don't
get
locked
in
on
a
single
vendor.
You
want
to
make
sure
that
it
has
like
a
large
community
behind
it,
so
that
you
get
the
support
and
the
patches
and
the
upgrades
which
you
need
to
be
successful
and
I.
B
Think
considerations
like
this
like?
Is
there
a
strong
Foundation
behind
it?
Is
there
like
multiple
different
industry
leaders
who
are
backing
the
language
is
really
really
critical
and
the
rest
Foundation
has
a
lot
of
big
players
who
who
are
supporting
it?
So
Amazon
is
one
of
the
key
supporters
of
the
Russ
Foundation.
B
We
just
joined
the
Russ
Foundation
as
well,
so
jfrog
is
now
a
premier
member
and
I'm,
serving
on
the
board
of
the
rest
foundation
and
there's
a
whole
bunch
of
other
large
companies
which
are
investing
a
lot
Microsoft
as
well,
so
a
whole
bunch
of
companies
which
are
investing
a
lot
to
make
the
rusty
ecosystem.
Successful
and
I
think
they
see
the
same
sort
of
long-term
value
in
investing
in
memory
safe
languages
and
doing
things
in
a
in
a
way
which
they
can
improve
the
security
of
the
ecosystem.
And
that's
why
they're
doing
this.
B
Yeah
yeah
we
we
we
don't
want
to
so
I
was
I
was
obviously
you
know
as
any
good
presenter.
I
was
finishing
my
slides
right
before
the
talk
and
because
Cassandra
is
teaching
one
of
the
kids
workshops
here
is
looking
over
my
shoulder.
So
what's
your
favorite
slide
in
this
talk,
yeah
yeah
the
kitty.
So
you
got
you
get
you
get
points.
D
D
So,
while
the
Russ
Foundation
helps
manage
and
Shepherd
various
programs
initiatives
like
we
have
a
community
grants
program
where
we
provide
funding
to
those
that
apply
and
are
accepted
to
do
Rust
things
in
the
rust
ecosystem.
We
have
a
cloud
compute
efforts
which
provides
access
to
like
high-level
infrastructure
for
folks
to
develop
on
the
rust
Pro
to
develop
the
rust
projects
that
we're
not
doing
all
this
on
their
laptop
and
things
or
taking
hours
to
compile
and
test
and
all
that
sort
of
stuff.
D
I
think
yeah
next
next
slide
next,
one
after
that
I
think
yeah
thanks
so
vulnerabilities,
like
solarwinds,
produced
a
response
from
the
US
government
through
executive
order,
14028,
which
basically
mandated
solutions
to
solving
security
and
software
supply
chain
issues.
We
would
like
to
see
recipe
considered
a
legitimate
candidate
for
this
type
of
software
work
because
of
its
focus
on
being
such
a
secure
and
safe
language.
There's
a
list
of
programming
languages
on
the
National
Institute
of
Standards
and
Technologies
website.
D
Both
security
and
software
Engineers
to
directly
work
with
the
rest
project
and
within
the
Russ
ecosystem,
determine
gaps
and
help
Implement
best
security
practices
and,
in
addition,
we're
going
to
hopefully
engage
with
other
external
efforts
like
through
the
aforementioned
open
security,
open,
secure,
open
source
security
foundation
and
relevant
government
initiatives.
To
advocate
for
rust's
role
in
developing
safe
and
secure
software-
and
this
brings
me
back
to
Steve
bit
Persia-
can
play
a
role
in
helping
secure
the
software
supply
chain
and
I'm
going
to
let
Steve
talk
more
about
that
now.
Cool.
B
Thanks
Joel
one
more
one,
more
comment
on
security
and
I.
I
think
this.
This
is
another
important
consideration
when
you're
looking
at,
like,
like
investments
in
in
particular
programming
languages
and
ecosystems,
so
I'm
I'm,
probably
you
can
tell
from
my
Twitter
handle
best
best
known
for
for
being
a
long
time.
B
Resolving
all
the
outstanding
security
issues
and
the
the
team
basically
stopped
feature
development
for
a
couple
years,
just
to
focus
on
paying
down
technical
debt
on
security
issues
and
I.
Think
that
for
for
a
relatively
new
language
ecosystem
like
rust,
to
to
have
the
foundation
understand
and
be
making
these
Investments
early
in
and
getting
additional
security
researchers
to
be
looking
for,
exploits
making
Pro
putting
priority
with
the
rust
security
team
on
quickly
addressing
and
fixing
any
security
issues
which
are
outstanding
and
basically
paying
down
this.
B
B
It
makes
attacking
the
code
base
harder
for
potential
attackers
who
are
looking
at
it,
but
I
think
also
when
you
look
at
we're
talking
about
the
rust
Foundation,
when
you
look
at
foundations
and
ways
of
supporting
projects
going
forward,
the
CDF
is
also
a
really
strong
partnership
in
making
sure
that
Persia
remains
a
secure
and
open
and
viable
project
for
for
everyone
to
rely
upon
Downstream
for
it,
and
there
are
some
good
reasons
for
this,
so
I
mean.
First
of
all,
we
know
this.
B
Something
else
which
I
I
think
is
is
important
to
state
is
that
the
CDF
is
a
project
focused
foundation,
and
this
means
that
it
has
really
good
infrastructure
for
supporting
new
projects
for
making
sure
that
they
get
the
right
technical
oversight.
They
have
the
right
contributions
and
that
that
you
know
the
health
and
future
prospects
of
projects
joining
the
CDF
are
well
maintained.
I
think
this
is
very
similar
to
the
cncf.
B
If
you
see
the
cncf
is
kind
of
the
big
umbrella
approach
where
they
accept
all
projects
but
I
think
what's
also
unique
about
the
CDF.
It
is
a
very
strong
focus
on
continuous
delivery,
so
both
project
focused-
and
it's
also
relevant
for
the
domain,
which
we
care
a
lot
about.
Doing.
Reproducible
builds
verification
of
builds
integrating
with
CI
CD
systems
to
provide
them
highly
reliable
systems
for
doing
doing
your
Downstream
bills
that
are
based
on
open
source,
and
this
aligns
well
with
the
CDF
calls
which
are
continuous
delivery.
B
Securing
the
the
devops
pipeline
and
making
sure
that
we
have
a
strong
foundation
for
all
of
our
work
in
this
space.
So
I
think
it's
a
really
really
great
alignment
with
the
CDF
mission
and
for
our
governance
model.
This
also
is
tied
in
really
well
with
how
the
CDF
runs
projects
and
to
to
give
some
more
details
on
this.
B
You
can
run
Runners
which
are
going
to
do
builds
for
Persia
in
Jenkins
and
or
tecton
are
your
choice
of
Runner
and
what
we
do
is
we
we
set
it
up.
So
it's
a
vendor,
neutral
organization,
where
all
of
these
companies
are
running
their
builds,
they're,
doing
verification
across
the
builds
they
get
and
those
are
what
get
published
to
the
Persia
peer-to-peer,
Network
and
I
think
this
model
works
well,
because
we
have
now
have
a
governance
body
which
can
do
things
like
control.
B
B
So
it
helps
us
to
keep
the
the
overall
governance
of
the
project
balanced,
and
this
supports
kind
of
this
model
of
having
a
decentralized
network
and
also
having
a
strong
verification
and
review
of
the
builds
which
are
getting
involved
and
to
get
more
involved
in
this
project.
There
are
a
couple
ways,
so,
if
you're
part
of
the
CD
Foundation
or
if
you're
part
of
a
company
which
might
be
interested
in
contributing
to
this
infrastructure,
come
chat
with
myself
or
sudendra
or
Lori
who's
who's.
B
All
the
way
to
like,
like
help
contribute
to
the
project,
do
commitments
either
it's
on
the
rest
code
base
or
to
some
of
the
the
CI
CD
pipelines
for
doing
the
verified
builds,
and
the
second
thing
is,
if
you're,
an
individual
or,
if
you're,
just
an
open
source
hacker
who
wants
to
get
involved
in
the
project.
It's
a
fully
open
source
project.
It
has
contributors
from
the
both
the
member
companies
and
we
have
a
bunch
of
folks
who
are
not.
B
We
have
contributors
from
IBM
who's,
currently
not
a
member
company
from
some
independent
students
and
from
other
folks
who
are
just
contributing
to
open
source
and
it's
a
great
way
to
learn
the
rust
language
to
kind
of
explore
and
be
part
of
a
up-and-coming
open
source
project
and
I
think
you
know,
hopefully
a
lot
of
fun.
All
of
our
meetings
are
open.
You
can
attend
all
of
our
meetings
which
are
on
Zoom.
B
You
can
join
all
the
mailing
lists
or
the
slack
group,
and
it's
all
done
in
the
public,
so
it's
an
entirely
transparent
process
for
getting
involved
with
and
joining
the
the
Persia
project.
So
I
want
to
thank
everyone
for
listening
to
myself
and
especially
for
Joel
who's
joining
us
remotely
as
a
presenter
and
I
think
we
we
have
a
few
minutes
for
questions.
Okay,
so
yeah
we
can
Joel
and
I
can
take
a
few
questions
from
the
audience
on
any
of
the
topics
we
talked
about.
It
can
be
about
the
rust
Community.