Secure your Bazel artifacts using SLSA
summary
With a 700+% YoY increase in supply chain attacks the project automates SLSA provenance for Bazel builds via a GitHub Actions reusable workflow that runs Bazel, returns an artifact plus SLSA provenance JSON, signs it and records the signature in a Sigstore transparency log. Verification is a single command that checks artifact checksum, builder identity and commit. A Bazel rebuilder attempts reproducible rebuilds and finds many real-world repos non-hermetic (pip installs, OS toolchains), so some builds fail bit‑for‑bit comparison.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:13Insider risks in pipelines
- 7:09SLSA levels explained
- 10:42Generic vs language builders
- 13:12Understanding provenance files
- 16:05Verifying provenance in CI/CD
- 18:11SLSA rebuilder for dependencies
- 20:58Q&A
related talks
40mSLSA with Us: The Dance of AppSec
29mMake Your CI More Secure and Less Spicy with SLSA
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
40mStrengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
46mEnhancing Artifact Security with GitHub’s Build Provenance...
36mSpicing up Container Image Security with SLSA & GUAC
47mSecure software supply chain on a shoestring budget