Joshua has spent most of his career as a software engineer working on open source in the software supply chain and secure software delivery space. In his role as the security domain lead at the VMware Open Source Technology Centre, he contributes to upstream secure software supply chain projects and their integrations into the open source ecosystem, most notably as a maintainer of The Update Framework (TUF) and leading a team working to integrate TUF into the Python ecosystem. In addition to his upstream contributions, he acts as a developer advocate at VMware for open standards, open source technologies and best practices around securing software supply chains and contributing to open source projects. His noted works to date are on build tools (Yocto Project, OpenEmbedded), CI/CD systems, Linux distributions (MeeGo, Moblin, Tizen), UX for clamshell and tablet devices (GNOME), and more that he can't remember.
This is the second of two posts outlining some basic principles and practices for securing software supply chains. In part 1 of this series, I...
