Strengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption
summary
SLSA provenance ties each build to its workflow while SPDX SBOM lists every component; together they pinpoint what went into an artifact, who built it, and how to respond to incidents. Adoption shows progress: GitHub Actions generates SLSA attestations and RC1 1.2 release is out for SLSA, SPDX2 is widely used and SPDX3 tooling is emerging, embedded projects (Zephyr, YAKTO) already auto-produce SBOMs, and guac ingests both SLSA and SPDX so analysts can trace root causes instead of spending 75% of the time chasing issues.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:35What is SLSA
- 5:40SPDX evolution
- 8:11Actionable SBOMs
- 13:27Adoption of SLSA/SPDX
- 20:28Synergies SLSA/SPDX
- 25:43Future outlook
- 31:43SLSA provenance security
- 34:11Attestation standards
- 37:18Final remarks and key takeaways
related talks
14mSLSA - A supply chain security framework
14mKeynote: The Next Steps in Software Supply Chain Security
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
40mSLSA with Us: The Dance of AppSec
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
44mImproving the Software Supply Chain Security
33mAutomation of SBOM Assessment in AGL Development Process