Continuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
summary
An assessment tool is demonstrated that parses SLSA 0.1 provenance and actually verifies claims: it detects tampered artifacts and typosquatted packages, confirms builds pulled from official repos, checks branch protection and commit signatures, validates builder identity and output image digests, and correlates dependency vulnerabilities. It cannot prove cache poisoning or full host hardening. The takeaway is adding builder hardened level and reinstating source tracking in provenance, plus work toward reproducible builds to raise assurance.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 0:44SLSA threat model overview
- 1:26SLSA 1.2 maturity levels
- 2:48Challenges with provenance claims
- 6:05Provenance verification methods
- 7:56Gaps in current SLSA adoption
- 9:02Future SLSA improvements needed
- 10:06Level 4 and reproducibility
related talks
40mSLSA with Us: The Dance of AppSec
14mSLSA - A supply chain security framework
59mIntroduction to SLSA
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
29mMake Your CI More Secure and Less Spicy with SLSA
20mReducing the Risk of Source Tampering With SLSA
15mAn Overview on SLSA
40mStrengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption