BEGIN:VCALENDAR
VERSION:2.0
PRODID:Linklings LLC
BEGIN:VTIMEZONE
TZID:America/Chicago
X-LIC-LOCATION:America/Chicago
BEGIN:DAYLIGHT
TZOFFSETFROM:-0600
TZOFFSETTO:-0500
TZNAME:CDT
DTSTART:19700308T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0500
TZOFFSETTO:-0600
TZNAME:CST
DTSTART:19701101T020000
RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DTSTAMP:20230124T171524Z
LOCATION:C141-143-149
DTSTART;TZID=America/Chicago:20221118T103900
DTEND;TZID=America/Chicago:20221118T110900
UID:submissions.supercomputing.org_SC22_sess447_ws_shpc102@linklings.com
SUMMARY:SpackNVD: A Vulnerability Audit Tool for Spack Packages
DESCRIPTION:Workshop\n\nSpackNVD: A Vulnerability Audit Tool for Spack Pac
 kages\n\nJeter, Bobbitt, Rountree\n\nSecurity models for Linux distro pack
 age security and interoperability have traditionally emphasized the use of
  more recent (more secure) versions at the occasional expense of execution
  reproducibility. A complementary approach (e.g., Lmod) allows access to m
 ultiple sysadmin-approved package versions. Another approach (e.g., Spack)
  enables a pure user space approach for package selection without system a
 dministrator oversight. While maximizing reproducibility, there is no user
  feedback regarding potential security vulnerabilities. We introduce a gen
 eral security model for package management and our implementation of Spack
 NVD, a security auditing tool for Spack. Users may query reported vulnerab
 ilities for specific package versions and can prevent installation where t
 he severity score exceeds a threshold. We emphasize this is a tool, not a 
 solution: Spack users are not expected to be security professionals. Howev
 er, this information may influence Spack concretizer decisions, and enable
  users to ask support staff about whether specific package versions are ap
 propriate for use.\n\nSession Format: Recorded\n\nTag: Security\n\nRegistr
 ation Category: Workshop Reg Pass
END:VEVENT
END:VCALENDAR