Securing build platforms
summary
Maps SLSA concepts to distribution build platforms and demonstrates a Yocto proof of concept: generates SLSA provenance metadata, signs it to bind artifacts to builders (build levels 1–3), and integrates that into yocto-autobuilder2 for OpenEmbedded. Covers practical gaps found by SUSE and Flatcar around verification, shows how reproducible-builds and Nix-style content-addressed inputs (and trusX-style multi-builder signatures) can raise confidence, and explains air‑gapped/hermetic build workflows and their limits.
AI-written summary · about
chapters (11)
- 0:00Introduction to build platforms
- 4:17Why securing build platforms matters
- 7:51Existing solutions and Salsa project
- 10:20Applying Salsa to OBS project
- 12:26Q&A on Salsa build levels
- 15:16Reproducibility and trusted builders
- 20:39Isolated builds and isolation levels
- 23:30Certification and trust ratings
- 24:57Air-gapped and offline builds
- 30:14Hermetic builds and side effects
- 32:02Final Q&A and wrap-up
related talks
45mSponsored Session: Because Security Matters: Securing Your Open Source Supply Chain
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
40mSLSA with Us: The Dance of AppSec
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
31mSLSA Conformance
44mSecuring a Yocto Built System
59mIntroduction to SLSA
14mSLSA - A supply chain security framework