Broadcom today at the VMware World Explore conference a set of hardened artifacts for the open source Spring framework, including the 5,000 dependencies that are needed to run it.
TrueSource Trusted Artifacts by Broadcom provides access to artifacts built in a clean room, including instances of Apache Tomcat, Kotlin, PostgreSQL, RabbitMQ, MySQL, and Valkey databases and middleware. It also extends to the Bitnami Secure Images catalog, adding hardened, verifiably built container images for hundreds of commonly used open source packages.
Based on the enterprise edition of the Spring framework that Broadcom supports, TrueSource Trusted Artifacts by Broadcom includes curated artifacts written in Java, Python and Node.js. Every library and artifact is selected against a reference architecture, then built and verified by human Broadcom engineers. That aspect of the service is critical because patches generated by AI coding that have not been validated by software engineers are much more likely to break an application running in a production environment.
Broadcom, via this service, will also scan customer repositories, assess the potential blast radius of each release, and then open pull requests based on the lowest-risk remediation path determined. There is also a set of dashboards through which DevSecOps teams can track what has been fixed and what tasks remain to be completed.
DevSecOps teams will also have the option to bring not-yet-public vulnerabilities they discover for early access remediation. In addition, there is a special program for critical infrastructure organizations that provides them with dedicated access to patch insights and mitigation advice.
Finally, Broadcom is committing to contributing the fixes it creates back to the maintainers of the open source software that it has remediated.
Purnima Padmanabhan, general manager for the Tanzu Division of Broadcom, said TrueSource Trusted Artifacts by Broadcom brings a lot of our open source capabilities together under one umbrella in a way that remains true to open source. In fact, Broadcom claims that over the past five months, engineers have already spent more than 12 billion tokens against frontier models to secure open source projects to ensure that every supported release line is patched before a Spring-related vulnerability is ever published.
Those efforts are crucial because earlier this year Broadcom revealed there has been a more than 1,700% surge in monthly security advisories reported by the Spring community, resulting in the largest set of security patches in Spring’s 23-year history being created and delivered.
Mitch Ashley, vice president and practice lead for software lifecycle engineering at The Futurum Group, said a curated pipeline inside the customer’s own build and deploy path addresses a key software supply chain requirement. Teams pull libraries, images, and data engines already built, signed, and pinned to the versions their release lines support, with automation that opens pull requests carrying the lowest-risk fix, he added.
That removes work enterprises absorb today: Triaging advisories, testing patches, and deciding what is safe to ship, noted Ashley.
It’s not clear to what degree exploits created using AI are starting to overwhelm DevSecOps teams, but the one thing that is clear is nearly all of them will require additional help to keep pace. After all, it’s not so much a question of whether there will now be more incidents so much as how much they can first be prevented and, just as importantly, rapidly contained.
from DevOps.com https://ift.tt/5PRxZfn
Comments
Post a Comment