Lightning Talk: (Micro)Chips and SLSA
summary
Defines how to reach SLSA Level 3 by showing a working reference implementation: CI server uses cosign to sign artifacts and in-toto attestations, a sidecar runs Open Policy Agent with Rego to validate policies, attestations land in Rekor and S3 and an S3→Lambda→OpenSearch pipeline makes them searchable. Demonstrates handling huge SBOMs (Keycloak SBOM ≈ 60,000 lines), cites SolarWinds’ 18,000 impacted customers and a 2% affected statistic for an XZ supply‑chain incident, and reports successful customer rollouts.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:02Recent supply chain attacks
- 3:11Expanding attack surface
- 4:15EO 14028 and compliance
- 6:01Challenges of handling Software Bills of Materials
- 7:49Introducing SLSA
- 8:52Understanding attestations
- 10:38Validating policies with OPA
- 11:21Reference implementation
- 12:04Conclusion
related talks
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
59mIntroduction to SLSA
22mFrom Mild To Wild: How Hot Can Your SLSA Be?
23mSpice Check: Building an E2E SLSA Implementation
33mSLSA FRSCA Recipe For Secure Supply Chain
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
11mLightning Talk: Automating Industry Regulation (SoX, SoC...