The State of Git Security With SLSA and Gittuf
summary
Demonstrates concrete tooling and results: GitHub embeds policy metadata into git so anyone with read access can verify compliance, the demo generates 126 attestations (one per merge) and marks the repository at SLSA source track level 3, and a new git layer called gittuf stores verifiable policies and provenance alongside commits; the source tool converts SLSA policies into GitHub rules and produces attestations, the demo commands run successfully and show per-commit and unified attestations that prove continuity and reviewer-based controls.
AI-written summary · about
chapters (11)
- 0:00Git security challenges
- 2:09Securing source code matters
- 3:13SLSA source track levels
- 7:25Evidence in SLSA
- 9:13Tools for SLSA source track
- 9:55What is gittuf
- 12:22Demo: gittuf with SLSA
- 17:43SLSA and gittuf summary
- 18:24Future for SLSA and gittuf
- 19:07Get involved next steps
- 19:47Q&A
related talks
38mSecuring Git Repositories with Gittuf
46mEnhancing Artifact Security with GitHub’s Build Provenance...
42mLessons Learned from Automating SLSA-Compliance Evaluation
27mThinking About Source Code Security in New Ways
29mMake Your CI More Secure and Less Spicy with SLSA
20mReducing the Risk of Source Tampering With SLSA
40mSLSA with Us: The Dance of AppSec
10mSource Attestations with Gitsign