Reducing the Risk of Source Tampering With SLSA
summary
SLSA Source Track defines concrete controls and four levels: Level 1 needs a VCS and revision-identifiers; Level 2 enforces protected-branch history retention and change-management; Source Level 3 requires contemporaneous signed provenance for every revision; Level 4 mandates two-person code review and binary provenance tooling. Implements real defenses against PHP 2021 and xz-style attacks, offers a GitHub Actions proof‑of‑concept and the git‑tough project, and ships as SLSA v1.2 RC1.
AI-written summary · about
chapters (11)
- 0:00SLSA and source tampering risks
- 2:51How SLSA safeguards integrity
- 4:37SLSA source track focus
- 6:47Source track level one
- 8:15Source track level two
- 10:02Source providence level three
- 11:49Code review level four
- 13:15Verifying commits with SLSA
- 14:39Implementing SLSA in Git
- 15:22SLSA source track status
- 16:04Q&A on SLSA
related talks
15mAn Overview on SLSA
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
29mMake Your CI More Secure and Less Spicy with SLSA
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
14mSLSA - A supply chain security framework
40mSLSA with Us: The Dance of AppSec
59mIntroduction to SLSA
42mLessons Learned from Automating SLSA-Compliance Evaluation