Trusted Open Source Catalogs for AI and Developers
Leslie Pascual of ActiveState joins Alan Shimel to explain why trusted open source catalogs — not after-the-fact scanners — are becoming table stakes as AI agents pull components at machine speed.
Open source supply chain security has long relied on scanners and known vulnerabilities, but this approach is no match for the rapid pace of AI agents pulling open source components. A trusted open source catalog is needed to vet components before they enter the environment, rather than scanning for issues after they cause problems.
Leslie Pascual, Field Engineering Manager for AI and Security Solutions at ActiveState, explains how such a catalog would work in practice. Packages go through a secure build, attestation, and provenance process before being added to a catalog that already covers the top nine open source ecosystems and is expanding to twelve. Continuous monitoring ensures the catalog remains current with patches and fixes, while SBOMs and attestations accompany every component.
The catalog integrates seamlessly with popular platforms like JFrog Artifactory, Sonatype, and Cloudsmith, allowing developers to access it without added friction. Mirrored repositories enable customers to host the catalog within their own Artifactory instances. Looking forward, AI agents will directly draw from this trusted catalog, replacing the need for agents to pull components from the internet indiscriminately.
The ultimate goal is to shift security left, embedding it within the catalog rather than relying solely on post-incident scanners. This approach would make AI-assisted development safe enough for enterprise teams to scale.
Written by urgent.news from DevOps.com's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
