A Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
summary
Survey of concrete tools and a working workflow: SBOM generators (CycloneDX/SPDX) from ProtoBom, sigstore + cosign + rekor for signing and immutable logs, intoto attestations baked into builds on minimal images (Alpine/Wolfi), and GUAC ingestion of OSV recalls to map transitive dependencies. The pipeline signs, records, and policy-checks artifacts with Policy Controller, detects a log4j contamination by querying GUAC’s graph, labels affected packages, and pushes patches so only verified images reach production via the GUAC visualizer. ProtoBom and GUAC visualizer demonstrate end-to-end recall and remediation.
AI-written summary · about
chapters (12)
- 0:00Supply chain security intro
- 3:10Why security matters now
- 7:20History of trusted code
- 10:08Government guidance on risks
- 13:38Building security solutions
- 18:14SLSA levels explained
- 21:44SBOMs for transparency
- 26:15Sigstore attestations
- 29:44Enforcement tools
- 31:51Commercial trade-offs
- 34:17Putting it all together in a workflow
- 35:37Q&A
related talks
37mEliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...
40mWhere Is the GUAC?
40mFresh SLSA and GUAC Starts with Knowing Your Ingredients
10mCharting the Course for Secure Software Supply Chain with Guac-AI-Mole!
28mProduction, Consumption, and the Data: The Open Source Security Sandwich
34mIt's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph!
20mEnforcing Supply Chain Security and Simplifying Compliance Audit...
44mImproving the Software Supply Chain Security