Skip to main content

Trusted Open Source Catalogs for AI and Developers

Open source supply chain security has been a scanner-and-CVE game for years — pull the package, run the scan, cross-reference known vulnerabilities, hope the metadata is current. That model always had gaps, and AI agents are widening them fast. Agents pull open source components from wherever they can find them, at machine speed, and the after-the-fact scan is not a control that keeps up. What developers and platform teams actually need is a curated catalog that vets components before they enter the environment, not after they cause a problem.

Alan Shimel sits down with Leslie Pascual, Field Engineering Manager for AI and Security Solutions at ActiveState, to work through what a trusted open source catalog looks like in practice and why it becomes table stakes as soon as AI agents join the software supply chain. Pascual brings more than 20 years across engineering, architecture and leadership, with a stint hardening enterprise healthcare applications that pushed her into cybersecurity. Her point is direct — scanners compare packages to CVE metadata after the fact, which is fundamentally different from vetting a component before it ships.

They get into the mechanics. Packages go through a cool-down period, secure build, attestation and strong provenance before landing in the catalog, which now spans the top nine open source ecosystems and is expanding to twelve — Python, Java, JavaScript, R and more. Continuous monitoring keeps catalogs current with patches and fixes, and SBOMs and attestations ship with every component. The integration side matters just as much: catalogs plug into JFrog Artifactory, Sonatype and Cloudsmith so developers see no extra friction, and mirrored repositories let each customer expose the catalog inside their own Artifactory instance.

The forward-looking piece is where AI agents plug in directly. Tools like Claude and Cursor need a source of truth for open source components, and Pascual argues that the trusted catalog becomes exactly that — the place agents pull from instead of grabbing whatever the internet returns. An MCP server is on the roadmap to extend that intelligence directly into the CI/CD pipeline. The broader read is that shifting security all the way left, past the scanner and into the catalog itself, is what actually makes AI-assisted development safe enough for enterprise teams to scale.



from DevOps.com https://ift.tt/mHPO5V8
Labels:

Comments

Post a Comment

Popular posts from this blog

In Nepal and Across the World, Child Marriage Is Rising

In Nepal and Across the World, Child Marriage Is Rising By Bhadra Sharma and Jeffrey Gettleman from NYT World https://ift.tt/3cbjEnR Nepal, Quarantine (Life and Culture), Coronavirus (2019-nCoV), Child Marriages, Youth, Women and Girls, Teenage Pregnancy, Pregnancy and Childbirth, Third World and Developing Countries, Birth Control and Family Planning
Post a Comment
Read more

Exadel Records Strong Year with Surge in Client Roster, Additions to Executive Team and Record-Breaking Company Growth

Success comes from growing need for digital transformation solutions and services amidst the COVID-19 pandemic WALNUT CREEK, Calif., January 12, 2021 — Exadel (www.exadel.com), a global provider of digital engineering solutions and services, announces a successful 2020 including a burgeoning client portfolio, continued growth, including new executive team members and 2020 sales projections. This year, […] The post Exadel Records Strong Year with Surge in Client Roster, Additions to Executive Team and Record-Breaking Company Growth appeared first on DevOps.com . from DevOps.com https://ift.tt/2LMO6eg
Post a Comment
Read more

AWS Adds Agentic Workspace to Kiro AI Coding Tool

Amazon Web Services (AWS) this week added an open source workspace for its Kiro artificial intelligence (AI) coding tool that enables application developers to asynchronously assign tasks to an AI agent that is capable of autonomously performing tasks, such as testing code as it is created, in a way that maintains context across multiple sessions. Darko Mesaros, a distinguished developer advocate at AWS, said the Kiro Crew workspace is also capable of creating reusable AI skills by observing the tasks developers assign to Kiro as they write code. Kiro Crew orchestrates agents using the Agent Client Protocol (ACP) to ensure every step is observable in real time as sub-agents are spawned. For example, developers can also hand off a ticket queue to Kiro Crew for it to triage issues and flag what needs their attention or ask it to investigate the root cause of an incident while a developer continues to work on another task. An Activity view shows each agent’s reasoning, every tool call,...
Post a Comment
Read more