Compare commits
1 Commits
main
...
7e8ea2983c
| Author | SHA1 | Date | |
|---|---|---|---|
7e8ea2983c
|
@@ -34,10 +34,9 @@ jobs:
|
||||
fetch-depth: 1 # Fetch all history for .GitInfo and .Lastmod
|
||||
|
||||
- name: Setup required tools (Hugo)
|
||||
uses: https://github.com/jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
|
||||
uses: https://github.com/jdx/mise-action@e79ddf65a11cec7b0e882bedced08d6e976efb2d # v3.6.2
|
||||
with:
|
||||
cache: false # no cache on gitea
|
||||
github_token: ${{ secrets.GH_TOKEN }}
|
||||
|
||||
- name: Create configuration for Matomo
|
||||
run: |
|
||||
@@ -46,19 +45,11 @@ jobs:
|
||||
sed -i "s|__PROXY_URL__|${{ secrets.MATOMO_PROXY_URL }}|" static/config.php
|
||||
sed -i "s|__TOKEN_AUTH__|${{ secrets.MATOMO_TOKEN_AUTH }}|" static/config.php
|
||||
|
||||
- name: Check for broken links
|
||||
run: |
|
||||
if [ "${{ gitea.ref }}" = "refs/heads/main" ]; then
|
||||
mise linkcheck --offline || true
|
||||
else
|
||||
mise linkcheck --offline
|
||||
fi
|
||||
|
||||
- name: Build website with Hugo
|
||||
run: mise run build
|
||||
run: hugo
|
||||
|
||||
- name: Copy website to host
|
||||
uses: https://github.com/appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
|
||||
uses: https://github.com/appleboy/scp-action@v1.0.0
|
||||
with:
|
||||
host: mehl.mx
|
||||
username: maxmehl
|
||||
|
||||
@@ -12,9 +12,6 @@ summaryLength = 50
|
||||
leftDoubleQuote = '“'
|
||||
rightDoubleQuote = '”'
|
||||
|
||||
[markup.goldmark.renderHooks.link]
|
||||
useEmbedded = "fallback"
|
||||
|
||||
[permalinks]
|
||||
blog = "/blog/:year/:slug"
|
||||
|
||||
|
||||
@@ -53,4 +53,4 @@ Any further questions? Do not hesitate [to ask me][3]!
|
||||
|
||||
[1]: /2015/naechste-station-tansania
|
||||
[2]: /uploads/tanzania-map.png
|
||||
[3]: /contact
|
||||
[3]: //max.mehl.mx/contact
|
||||
|
||||
@@ -19,7 +19,6 @@ slides: https://fosdem.org/2026/events/attachments/ZSWH3N-deutsche-bahn-supply-c
|
||||
event:
|
||||
name: FOSDEM 2026
|
||||
href: https://fosdem.org/2026/schedule/event/ZSWH3N-deutsche-bahn-supply-chain-cra-strategy/
|
||||
mastodon_toot_url: "https://mastodon.social/@mxmehl/116160561981890042"
|
||||
---
|
||||
|
||||
At FOSDEM 2026, I presented Deutsche Bahn's software supply chain strategy in the context of the EU Cyber Resilience Act (CRA), but made clear from the start that CRA was the context, not the trigger. We didn't adopt SBOMs because of regulation – regulation validated the direction we were already taking based on operational needs. The presentation positioned our work at the intersection of CRA compliance requirements, IT operation best practices, and the practical realities of running IT infrastructure for an organization with 220,000+ employees, 7,000+ IT applications, and 100,000+ Open Source components.
|
||||
|
||||
@@ -19,7 +19,6 @@ slides: https://fosdem.org/2026/events/attachments/7EYTRJ-deutsche-bahn-large-sc
|
||||
event:
|
||||
name: FOSDEM 2026
|
||||
href: https://fosdem.org/2026/schedule/event/7EYTRJ-deutsche-bahn-large-scale-sbom-approach/
|
||||
mastodon_toot_url: "https://mastodon.social/@mxmehl/116160570821178215"
|
||||
---
|
||||
|
||||
At FOSDEM 2026, I presented Deutsche Bahn's journey from operational need to concrete implementation of large-scale SBOM collection and use. The scale is staggering: approximately 500,000 SBOMs across our software supply chain expected, covering 7,000+ IT applications, 100,000+ Open Source components, and diverse sourcing streams from software we build ourselves to what we buy and operate. The talk focused on how we moved from understanding that "we need to know, in real-time, which exact component is used where and how" to actually making this happen in an organization with 220,000+ employees and hundreds of subsidiaries.
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
---
|
||||
title: "Getting Real with the Supply Chain: From SBOM Data to Action"
|
||||
date: 2026-03-17
|
||||
categories:
|
||||
# Language
|
||||
- english
|
||||
# - deutsch
|
||||
- presentation
|
||||
# - podcast
|
||||
# - article
|
||||
tags:
|
||||
- OSPO
|
||||
- SupplyChain
|
||||
- DeutscheBahn
|
||||
headerimage:
|
||||
src: max-cornelius-stage.jpg
|
||||
alt: Cornelius Schumacher and Max Mehl giving the presentation at FOSS Backstage 2026. It's a total view of the auditorium from the back, with the two speakers on stage and the final slide in the background.
|
||||
# summary: Visible on the listing page, but not on the article page
|
||||
video: https://www.youtube.com/watch?v=M8wYRRCWaQU
|
||||
slides: https://up.mehl.mx/slides/2026-03-17-foss-backstage-supply-chain.pdf
|
||||
event:
|
||||
name: FOSS Backstage 2026
|
||||
href: https://26.foss-backstage.de/session/getting-real-with-the-supply-chain-from-sbom-data-to-action/
|
||||
---
|
||||
|
||||
At DB, we handle 100,000+ SBOMs per day. For our small, virtual Open Source Program Office (OSPO), the challenge is not to get lost in the data, but to cut through the jungle and identify real risks. Together with my OSPO colleague Cornelius Schumacher, I presented this challenge at the FOSS Backstage conference in Berlin. We explained how we gather data, generate insights, and take action.
|
||||
|
||||
This talk was partly inspired by my earlier FOSDEM talks ([here](/blog/2026-01-fosdem-supply-chain-strategy) and [there](/blog/2026-02-fosdem-sbom-collection)), where I focused on DB's SBOM program and its tools. In this presentation, however, we highlighted what can be learned from it for professional Open Source management.
|
||||
|
||||
One topic stood out throughout the presentation: the need for an OSPO to balance between people, value, and risk. None of these should dominate, even though governance functions often tend to focus on risk. Instead, Cornelius and I advocated for a risk-based approach to managing Open Source.
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 221 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 797 KiB |
@@ -1,28 +0,0 @@
|
||||
---
|
||||
title: "Software-Lieferketten bei der Deutschen Bahn"
|
||||
date: 2026-03-25
|
||||
categories:
|
||||
- deutsch
|
||||
- podcast
|
||||
tags:
|
||||
- Community
|
||||
- DeutscheBahn
|
||||
- SupplyChain
|
||||
summary: Ich wurde mal wieder von Ralf Hersel zum “Captain it’s Wednesday” Podcast von GNU/Linux.ch eingeladen, um über Software-Lieferketten bei der Deutschen Bahn zu sprechen. Anlass waren meine jüngsten Vorträge auf der FOSS Backstage und der FOSDEM, in denen ich über die Herausforderungen und Chancen von Software-Lieferketten bei der DB gesprochen habe.
|
||||
headerimage:
|
||||
src: ciw.jpg
|
||||
alt: The famous "Captain it's Wednesday" comic
|
||||
processes:
|
||||
- fill 1000x440 center webp
|
||||
audio: https://gnulinux.ch/podcast/CIW175.mp3
|
||||
event:
|
||||
name: Captain it's Wednesday Podcast
|
||||
href: https://gnulinux.ch/ciw175-podcast
|
||||
mastodon_toot_url: https://mastodon.social/@mxmehl/116318946107759692
|
||||
---
|
||||
|
||||
Ich wurde mal wieder von Ralf Hersel zum "Captain it's Wednesday" Podcast von GNU/Linux.ch eingeladen, um über Software-Lieferketten bei der Deutschen Bahn zu sprechen. Anlass waren meine jüngsten Vorträge auf der [FOSS Backstage](/blog/2026-03-foss-backstage-getting-real-supply-chain) und der [FOSDEM](/blog/2026-01-fosdem-supply-chain-strategy), in denen ich über die Herausforderungen und Chancen von Software-Lieferketten bei der DB gesprochen habe.
|
||||
|
||||
Mit Ralf habe ich mal ganz vorne angefangen: was ist eine Software-Lieferkette überhaupt, warum ist sie wichtig, und wie sieht sie bei einem großen Unternehmen wie der Deutschen Bahn aus, und was haben diese SBOMs damit zu tun? Wir haben über die enormen Mengen an Software-Komponenten gesprochen, die täglich bei der DB verarbeitet werden, und wie wir versuchen, den Überblick zu behalten und Risiken zu managen. Dabei ging es auch um die Rolle von Freier und Open Source in der Lieferkette und wie wir dabei mit der Community zusammenarbeiten.
|
||||
|
||||
Nach exakt 37 Minuten war das Gespräch auch schon wieder vorbei und natürlich konnten wir nicht in jedes Detail eintauchen. Aber ich hoffe, es war dennoch ein interessanter Einblick für die Zuhörenden.
|
||||
33
mise.toml
33
mise.toml
@@ -1,33 +1,2 @@
|
||||
[tools]
|
||||
hugo-extended = "0.159.1"
|
||||
lychee = "latest"
|
||||
|
||||
[vars]
|
||||
build_dir = "public"
|
||||
|
||||
[tasks.cleanup]
|
||||
description = "Clean up the build destination directory"
|
||||
run = "rm -r {{vars.build_dir}} || true"
|
||||
|
||||
[tasks.build]
|
||||
depends = ["cleanup"]
|
||||
description = "Build the static site using Hugo"
|
||||
run = "hugo -d {{vars.build_dir}}"
|
||||
|
||||
[tasks.preview]
|
||||
depends = ["cleanup"]
|
||||
description = "Preview the site locally using Hugo's built-in server"
|
||||
run = "hugo server"
|
||||
|
||||
[tasks.linkcheck]
|
||||
depends = ["build"]
|
||||
description = "Check for broken links using lychee"
|
||||
run = '''
|
||||
lychee \
|
||||
--max-concurrency 5 --cache --max-cache-age 1h \
|
||||
--index-files 'index.html' \
|
||||
--root-dir {{vars.build_dir}}/ \
|
||||
-u 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple WebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36' \
|
||||
--exclude 'glyphicons-halflings-regular\.(eot|woff|woff2|ttf|svg)' \
|
||||
{{vars.build_dir}}/
|
||||
'''
|
||||
hugo-extended = "0.157.0"
|
||||
|
||||
@@ -363,13 +363,6 @@ div.contact p {
|
||||
margin-top: 0;
|
||||
}
|
||||
}
|
||||
// First and last card in the list have different border radius
|
||||
.row:first-child .card {
|
||||
border-radius: 1rem 1rem 0 1rem;
|
||||
}
|
||||
.row:last-child .card {
|
||||
border-radius: 0 1rem 1rem 1rem;
|
||||
}
|
||||
}
|
||||
|
||||
/* Helpers */
|
||||
|
||||
@@ -65,9 +65,7 @@
|
||||
</div>
|
||||
<div class="col-xs-9 col-md-10">
|
||||
{{ if $selection }}
|
||||
{{- with .OutputFormats.Get "RSS" -}}
|
||||
<span class="article-rss"><a class="label label-rss" href="{{ .Permalink }}" title="RSS Feed"><i class="fa fa-rss" aria-hidden="true"></i> Subscribe to »{{ $.Title }}«</a></span>
|
||||
{{- end -}}
|
||||
<span class="article-rss"><a class="label label-rss" href="/{{ .Data.Plural }}/{{lower .Title}}/index.xml" title="RSS Feed"><i class="fa fa-rss" aria-hidden="true"></i> Subscribe to »{{.Title}}«</a></span>
|
||||
{{ else }}
|
||||
<span class="article-rss"><a class="label label-rss" href="/blog/index.xml" title="RSS Feed"><i class="fa fa-rss" aria-hidden="true"></i> Subscribe to all posts</a></span>
|
||||
{{ end }}
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
{{- if .Params.heading -}}
|
||||
{{- $title = .Params.heading -}}
|
||||
{{- else -}}
|
||||
{{- $title = printf "%s | %s" .Title .Site.Title -}}
|
||||
{{- $title = print .Site.Title " | " .Title -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
<meta charset="utf-8" />
|
||||
|
||||
@@ -13,10 +13,9 @@
|
||||
|
||||
<!-- Theme stylesheet, combination of all in assets/scss -->
|
||||
{{- $style := resources.Get "scss/main.scss" | resources.ExecuteAsTemplate "scss/main.scss" . | toCSS (dict "targetPath" "css/main.css" "enableSourceMap" false) }}
|
||||
<link rel="stylesheet" href="{{ ($style).RelPermalink }}?v={{ md5 $style.Content }}">
|
||||
<link rel="stylesheet" href="{{ ($style).RelPermalink }}?v={{ md5 time.Now.Unix }}">
|
||||
|
||||
<!-- Custom CSS -->
|
||||
{{- range .Site.Params.custom_css }}
|
||||
{{- $md5 := md5 (readFile (printf "static/%s" .)) }}
|
||||
<link rel="stylesheet" href="{{ relURL . }}?v={{ $md5 }}" />
|
||||
<link rel="stylesheet" href="{{ relURL . }}?v={{ md5 time.Now.Unix }}" />
|
||||
{{- end }}
|
||||
|
||||
Reference in New Issue
Block a user