Analyzing Google’s SLSA Framework for Securing Software Supply Chains
summary
Claims that SLSA defines SLSA levels 0–4 with concrete controls: scripted builds and provenance at level 1, hosted build and signing at level 2, stronger auditability at level 3, and two-person review plus reproducibility at level 4. Recommends generating signed provenance that lists exact dependencies, isolating CI/CD (examples like GitHub Actions), using commit signing and MFA for admin accounts, and treating reproducible builds and cross-build comparison as practical mitigations. Notes attacks rise 4X from 2020 to 2021 and that SLSA excludes runtime production checks and secret exposure handling.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:102021 is the Year of the Software Supply Chain Attack
- 5:24The SDLC has collapsed into SCMS
- 7:47Google's SLSA Levels
- 10:52Google's SLSA framework - Source
- 11:33Source - Out of Scope
- 13:24Google's SLSA framework - Build
- 14:57Google's SLSA framework - Provenance con
- 16:44Build & Provenance - Out of Scope
- 17:42Google's SLSA framework - Common
- 18:31Common - Out of Scope
related talks
59mIntroduction to SLSA
29mGoogle SLSA & NIST SSDF: Emerging Software Supply Chain Security Best Practices
15mAn Overview on SLSA
14mSLSA - A supply chain security framework
29mMake Your CI More Secure and Less Spicy with SLSA
20mReducing the Risk of Source Tampering With SLSA
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
40mSLSA with Us: The Dance of AppSec