Chainguard Assemble 2025 | Jason van Zyl, Chainguard

Clips
More from Chainguard Assemble 2025

Jason van Zyl

Software Engineer

Chainguard

play_circle_outline Data supply chain concept and the importance of terminology in communication.

play_circle_outline Evolution of Maven registry and challenges faced in the past.

play_circle_outline Secure Future: Chainguard Libraries Expand Coverage to Java, Python, and JavaScript for Enhanced Security Measures

play_circle_outline Impact of security breaches in open source and the need for proactive measures.

Info
Transcript

Jason van Zyl, Chainguard

Jason van Zyl

Software Engineer Chainguard

Exploring Secure Open Source Libraries with Chainguard's Jason van Zyl

In this insightful segment from Chainguard Assemble 2025, we welcome Jason van Zyl, principal engineer at Chainguard, as they discuss the latest advancements and challenges in secure open source libraries. This discussion occurs in the vibrant setting of San Francisco, hosted by theCUBE's Savannah Peterson and Jackie McGuire.

Van Zyl, with an extensive background in Java development and contributions to projects such as Maven, lends their expertise to the discussion at Chaing... Read more

explore Keep Exploring

What concept do you really like? add

What were some of the obstacles faced in hosting Maven and Maven Central at the Apache Software Foundation 25 years ago? add

What steps are being taken to continuously evolve and mitigate the multitude of risks that exist in today's environment? add

What is the importance of a long-term approach in cybersecurity defense and the patience of adversaries in comparison to quick hits? add

bolt Powered by CUBE AI

Jason van Zyl, Chainguard

search

Savannah Peterson

>> Good afternoon, Chainguardians, and welcome back to San Francisco, California. We're here at Chainguard Assemble with our final segment on what has been such an insightful day. My name's Savannah Peterson here with our rising superstar, Jackie McGuire, who I'm sure you've fallen in love with today. Jackie, what's the coolest thing you've learned so far today?

Jackie McGuire

>> Hmm. Other than the fact that the whole Chainguard crew has a pretty ferocious hair game, I really... I know that's crazy. But I love the concept of the data supply chain, like I really like... It was, for me, we had Kit from Plainsight Technology on, and he was talking about not just the software supply chain, but the data supply chain. And I've been calling it a data audit trail, which he pointed out probably scares people so that, I... Those little tweaks in wording, I think, are what actually make the difference between things getting done and things not and people truly understanding the problem. So I know it's a small thing, but that was pretty big for me.

Savannah Peterson

>> I think that makes sense. When we all have the same shared lexicon, we can all build together. Talking about someone who cares about shared lexicon and libraries and a lot of things-

Jackie McGuire

>> Oh, that ....

Savannah Peterson

>> we've got Jason van Zyl here from the Chainguard team. Thank you so much for hanging out with us this afternoon.

Jason van Zyl

>> No problem. Thanks for having me.

Savannah Peterson

>> So you're kind of an OG when it comes to the library game, when it comes to Java. You've got a lot of experience here. Talk us through what you all announced today and then we'll dive into a little bit of why that's so cool and how well you know the journey.

Jason van Zyl

>> Sure. So today, we announced Chainguard libraries. It's part of the portfolio at Chainguard. We started with Chainguard images. We announced Chainguard VMs today and libraries is the third part of that story. So it focuses on trying to provide developers with what they need for developing applications and largely driven by customer demand. We hope that it rounds out what every customer needs to build every piece of software that they have inside their organization.

Savannah Peterson

>> It's a casual statement, every piece of software.

Jason van Zyl

>> Yeah.

Savannah Peterson

>> So you've had the opportunity to work on the world's most popular registries for libraries. They are not always the fastest adopted. Talk to me about your experience there and why you think this time it's going to be different with Chainguard.

Jason van Zyl

>> So the project that I worked on almost 25 years ago, Maven and Maven Central, they weren't the first registries made, but they were close to the first registries being made. Python's PyPy was out about a year earlier and then Maven Central was in 2001, 2002. Maven, itself, is a project at the Apache Software Foundation. Great people there. How Maven ended up there is a bit of historical happenstance, but the original project that the ASF became famous for was the HDDBD server and they had a long history of building from source. The ideas of Maven and Maven Central ran counter to a lot of their philosophy. So they wanted to build everything from source. They wanted everything to be Apache licensed. They only wanted to deal with Apache licensed libraries. So one of the major parts of Maven was the registry that serves all of the libraries. So that couldn't be hosted at the Apache Software Foundation or they didn't want it hosted there. So this was 25 years ago. I was relatively new to open source. I wasn't really sure what to do. It ended up being hosted on a machine in my house for a while until-

Savannah Peterson

>> Oh my goodness....

Jason van Zyl

>> other organizations-

Savannah Peterson

>> Taking matters into your own hands in your own house.

Jason van Zyl

>> Yeah. I biblio-hosted it for a while. And then, Centegix. It is a cloud-based company that... They did all of Atlassian's cloud-based hosting, Jira, Confluence. So it was slow to be adopted. It wasn't really... I wouldn't say it wasn't welcomed at the Apache Software Foundation. Maven is still there, but the Maven Central part of it was not something that worked out well there. Maven was hard to explain to people. The registry was hard to explain to people. The first couple years of its life, it was adopted very slowly. No one really wanted to talk about a common infrastructure or shared infrastructure and-

Savannah Peterson

>> Yeah. You were probably catalyzing some of those initial conversations.

Jason van Zyl

>> Trying to. I mean, still, it was 25 years ago. I was new to open source, wasn't an amazingly effective communicator. It was difficult and it took a few years for it to actually get any traction.

Savannah Peterson

>> So fast-forwarding 25 years, we're here today talking. How has it evolved? If you were to have predicted back then, would you have seen the open source community doing what it's doing now?

Jason van Zyl

>> Not at all. I had no way to predict. I wasn't expecting anybody to use either of the projects. It wasn't anything that I had imagined. But over the course of the last 25 years, Java became popular in large enterprises, portable runtime, relatively easy language to understand. Open source Java projects, the number of them exploded, Code House, JBoss, all of the Apache projects, HDFS, Hive, and Spring. So all of that made using open source Java difficult because of the huge dependency chains that it had. So Maven became popular in large organizations. Two other people and myself, Brian Fox, and Thomas Cernyak, we started Sonatype. That's where the Nexus repository manager came from. So large organizations started using Maven, adopted repository managers so it... Sonatype was founded and that is when Maven took off. The open source portal was created, so that's where we let anybody in the world submit projects to be used by everybody. And yeah, I never would have imagined that it would be in the place where it is today. There's billions of requests made to Maven Central. Brian Fox is still running the show at Sonatype. They've taken care of Maven Central for years and I think it's a resource the Java ecosystem wouldn't be able to survive without at this point.

Jackie McGuire

>> What have you taken from that learning experience granted it was a long time ago? But now, that we've gotten to a place where packages are just an accepted necessity for everything that we do, when you think about Chainguard libraries, what are the lessons that you've brought with you and that you feel really differentiate Chainguard libraries from other open source libraries?

Jason van Zyl

>> Good question. I respect all the work that open source projects and what they do and how they work. But I think it's a problem that requires a huge amount of talent, a great deal of money. And even though the open source registries have some forms of funding, I think the security is something that needs to be addressed. So that's where I think-

Jackie McGuire

>> XZ Utils comes to mind?

Jason van Zyl

>> Yeah. A lot of the repositories have some measures of security. But still, the provenance of where the source code come from, how it's built, that it's built in a hardened environment and the tooling that we're building for trying to detect problems in software. I think just require a level of resources and cohesion that is not possible in most open source communities. So I think Chainguard, again, puts together the whole story with security from end-to-end. Again, everything that anybody would want to build with a container, a VM, a library, Chainguard will provide a holistic solution.

Jackie McGuire

>> I almost think about it like automobiles. It used to be 20 years ago, you could just slap apart from one manufacturer onto another. You could build whatever you wanted. But these days, because of all... I have this car that's got these full self-driving sensors, so it's like you have to be 100% sure each and every component from that vehicle came from a verified source, was installed by the manufacturer, is not taking pictures of your house. Because I can hit a button on my phone and my car takes a 360 picture around itself, it can go into the cabin. So I think about it that way too, is that I probably never would have thought about before like, "Oh, are the sensors in my car OEM? Can I be sure they came from a reputable source?" And it's that way with software where it used to be like, "Oh, you might have a couple libraries or dependencies." And now, you're talking about these pages-long lists. And yeah, as a data scientist-

Savannah Peterson

>> Good point....

Jackie McGuire

>> I was really, really ill-equipped to understand libraries, to understand the source of the stuff coming from those libraries. So, to me, it's if we're going to continue to empower people in an enterprise to build things and to use technology as a tool, this kind of verification of where these things are coming from seems like a critical component of that.

Jason van Zyl

>> Yeah. The cognitive overhead of any normal developer or organization trying to understand that list, where it came from, verifying it is not something I don't think they're particularly interested in. They would just like to know that it's safe. That's what Chainguard provides. And we're just trying to make that easier so that people can actually just focus on doing the work that they want and that they're safe.

Savannah Peterson

>> I love that analogy. I'm going to be thinking about that now in a lot of different ways. We were already talking about Cybertrucks up here today. I'm already like, "Oh, interesting." Very good anecdote there, Jackie. Let's talk a little bit about nefarious behavior. We're seeing, obviously, a rise, 3x, in the case of malicious open-source packages. Up to over 700,000 malicious packages detected last year according to the notes your team was kind enough to provide. That's a lot. How are you continuously evolving to mitigate the multitude of risk that lies out there?

Jason van Zyl

>> So what we're focusing on first is trying to eliminate the attacks that happen in the build system and the distribution part of the system. So every library that we build, we find and verify where the source came from. We build it in a hardened environment and it's published to a place that is secure inside of our environment. In the future, we would like to do more in terms of scanning for malware. There's a lot of things that we would like to do to create further protections, but those attacks are probably not going to stop. I mean, just given economic conditions in the world where it's advantageous to write malware and perform those attacks, they're not going to decrease. And our research teams are trying to look for better ways to mitigate these attacks as the future goes on.

Savannah Peterson

>> I can imagine that's an ever-evolution. You all had some really exciting announcements today. What are you working on next that you can tease us with a little bit?

Jason van Zyl

>> So we announced Java today, but we are also working on libraries for Python and JavaScript.

Jackie McGuire

>> I already begged for Python-

Savannah Peterson

>> I was going to say, "Music to Jackie's ears."

Jackie McGuire

>> Yeah. There's two things I really need. One is better security controls in Python and the other is a Copilot to annotate my code because I'm also terrible at that, which is why I'm in media and not still a data scientist.

Savannah Peterson

>> What do you think? What are the questions I've been asking the wonderful team around you today, Usman? What do you think are some of the biggest myths in security and open source security or, well, open source as it relates to security today that you wish you could just educate the community on at the snap of your fingers?

Jason van Zyl

>> I don't like to fearmonger, but there are things like XZ that I am willing to believe there is probably a lot more of that out there and that the research is going to have to be a lot more proactive to try and find those things. I think people are aware with all the attacks that have happened in the last couple of years, that there are problems. But again, not fearmongering, but I imagine there's an order of magnitude more issues lurking out there that need to be found.

Jackie McGuire

>> For those who are unaware, which I assume is almost none of our audience. So XZ Utils, the attacker that actually inserted the backdoor in that, it was almost two years, they contributed legitimate code. They did good work. And that's, to your point, I think our adversaries think in terms of dynasties, not two or four-year political cycles. And so, the dwell time, I think the fact that it's been going up and up and up, it's not by accident. It's because the long approach is often much more successful than the quick hits. So I don't fearmonger either, but I would like to wholeheartedly double down on what you're saying in that we are facing... This is the new front of war and our adversaries tend to be more patient than we are and-

Savannah Peterson

>> I was literally just going to say, "The power is in their patience sometimes."

Jackie McGuire

>> Yep.

Jason van Zyl

>> And it's not. It's not a lot of... So if someone was to fund someone like that, I mean, on the order of a few million dollars over the course of a decade, is not really a lot of money for someone trying to plan something long-term. So I mean, I'm... We'll find out as the research shows in the next couple of years how prevalent the problem is.

Savannah Peterson

>> Yeah. What's the best part about working at Chainguard?

Jason van Zyl

>> It's been probably my new work family, I guess. It's having all people who understand many different aspects of security. So I've always been interested in security but have done more in like the libraries and build tool areas. So there are people that Chainguard has hired over the last three years that are experts in operating systems, VMs, containers, all of the infrastructure. So for me, it's always trying to learn new things and that's probably been the best part at Chainguard. And if there's one place in the world that actually will have a chance at fixing the security problem, it will be Chainguard.

Savannah Peterson

>> I love that. We've really had such a blast with everyone. It's no surprise that you say the team and the chosen family. It's been a very welcoming environment for us. I have one final question for you. When we're hanging out at next Assemble, let's say a year from now, what do you hope to be able to say then that you can't yet say today?

Jason van Zyl

>> That we would probably have 10 of the ecosystems covered. So hopefully, in the next-

Savannah Peterson

>> Nice. There we go-...

Jason van Zyl

>> while we'll have Java, Python, and JavaScript done, but that we would have more of those ecosystems covered in end-to-end solutions from containers, VMs, all the way up to the libraries.

Savannah Peterson

>> That's awesome. Okay, well we look forward to talking about that with you next time you're on theCUBE, Jason.

Jason van Zyl

>> Awesome.

Savannah Peterson

>> Thank you so much for taking the time to come hang out.

Jason van Zyl

>> Thank you for having me.

Savannah Peterson

>> And hello to all your Canadian friends. We love our friendly neighbors to the north.

Jackie McGuire

>> And thank you for everything that you have contributed to the open source community. It's-

Jason van Zyl

>> Happy to.

Savannah Peterson

>> Impressive.

Jackie McGuire

>> Reading your background was impressive, to say the least. So you are probably one of those people I tell people about who they may never know about, but significantly impacted what we do every day. So thank you.

Jason van Zyl

>> Thanks.

Savannah Peterson

>> I love that. What a wonderful sentiment. Thank you both and thank you for such a fantastic day, Jackie. Absolutely smashing it today-

Jackie McGuire

>> Hanging out with my bestie.

Savannah Peterson

>> Watch out, you all. You're going to get a lot of Jackie and Sav moving forward. Most importantly, thank you all for tuning into this fantastic power packed day, discussing security, open source technology, and all of the exciting announcements that our friends at Chainguard have shared at their fabulous Chainguard Assemble event. My name's Savannah Peterson. Signing off from San Francisco, California. You're watching theCUBE, the leading source for enterprise tech news.