SLSA - A supply chain security framework
summary
SLSA v1.0 (released April 18) defines concrete provenance and incremental requirements for builds: provenance JSON recordings, a verifier, and tooling for GitHub Actions and Jenkins. Level 1 requires that provenance exists; level 2 adds hosted build platforms and digitally signed provenance; level 3 requires builder isolation so builders cannot share credentials. The spec is early, level 4 is pending, SBOMs can be derived from SLSA provenance, and SolarWinds 2020 motivates adoption.
AI-written summary · about
chapters (8)
- 0:00Introduction to supply chain
- 1:02Software supply chain risks
- 5:15Introduction to Salsa
- 6:36Salsa tracks and levels
- 6:53Current state and evolution
- 8:10Build track requirements
- 9:33Tooling and Q&A
- 13:45Chain of trust and conclusion
related talks
15mAn Overview on SLSA
40mSLSA with Us: The Dance of AppSec
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
29mMake Your CI More Secure and Less Spicy with SLSA
31mSLSA Conformance
59mIntroduction to SLSA
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
40mStrengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption