From Mild To Wild: How Hot Can Your SLSA Be?
summary
Policy shows concrete checks and demos: verify builder identity, build type, source commit and signatures (about 50 checks run for a Red Hat UBI image), then generate a Verification Summary Attestation (VSA) to avoid revalidating every dependency, and finally chain provenance to upgrade to SLSA level 3 by validating Tekton task commits and isolation. Implementations use AMPEL and Conforma with cosign/OCI collectors; live demos prove each level and VSA speeds enforcement for admission controllers.
AI-written summary · about
chapters (6)
- 0:00SLSA and policy engines
- 2:28Mild verification of attestations
- 9:12Medium verification with VSA chaining
- 14:29Wild verification with trusted policies
- 19:02Summary and future of SLSA
- 21:08Q&A
related talks
15mAn Overview on SLSA
23mSpice Check: Building an E2E SLSA Implementation
31mSLSA Conformance
59mIntroduction to SLSA
29mMake Your CI More Secure and Less Spicy with SLSA
14mSLSA - A supply chain security framework
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
40mSLSA with Us: The Dance of AppSec