Introduction to SLSA
summary
SLSA defines four measurable levels (build → source → dependency) and claims you can raise supply-chain trust incrementally; the talk cites a 650% jump in supply-chain attacks in 2021, an 84% rise in OSS vulnerabilities, and ~70% of Docker Hub images carrying medium+ issues. It shows concrete tooling: Google Cloud Build with ephemeral builds and hermetic, reproducible builds, Artifact Registry scanning, attestations/signing, and binary authorization. Demo fails signing on a high-severity image then succeeds with a fixed Dockerfile and is promoted via Cloud Deploy.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:55Understanding Software Supply Chain
- 4:11Software Provenance
- 6:18Supply chain attacks are on the rise
- 12:15Steering Group
- 12:40SLSA Framework - Trust Boundaries
- 16:07Threats
- 21:54Software Supply Chain Integrity
related talks
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
14mSLSA - A supply chain security framework
15mAn Overview on SLSA
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
29mMake Your CI More Secure and Less Spicy with SLSA
35mPractical Guides for Enhancing Your Software Supply Chain Security
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue