Spice Check: Building an E2E SLSA Implementation
summary
An end to end SLSA implementation uses the AMPEL policy engine and the new SLSA 1.2 source track to enforce policies from commit to release: reusable GitHub Actions collect provenance, verifier policies check SLSA level 1 for commits and builder images, transformers merge OpenVEX suppressions into OSV scans, and subject chaining links commits → SBOM → binaries. A demo project called freeto generates signed VSA bundles with provenance, tests, SBOMs and vuln attestations, and the pipeline gates the build — the example runs and publishes verifiable bundles.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:06What is SLSA
- 3:11Ample policy engine
- 6:46Frido project deployments
- 10:22Supply chain security
- 12:08Policy structure
- 14:59Generating attestations
- 17:51Subject chaining
- 20:40Attestation bundle inspection
- 22:48Delivering trust
related talks
40mSLSA with Us: The Dance of AppSec
15mAn Overview on SLSA
22mFrom Mild To Wild: How Hot Can Your SLSA Be?
14mSLSA - A supply chain security framework
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
29mMake Your CI More Secure and Less Spicy with SLSA
40mStrengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption
59mIntroduction to SLSA