Make Your CI More Secure and Less Spicy with SLSA
summary
SLSA presents concrete, incremental requirements: SLSA levels 0–3 require automated builds, JSON provenance attestations and cryptographic signatures, and only GitHub Actions and Google Cloud currently meet level three certification. Producers generate signed provenance (builders exist for npm Go and Maven) and consumers verify signatures via sigstore or the GitHub Actions provenance action. Provenance is practical and lightweight but not a silver bullet: generators may not reach level three and SLSA does not stop a legitimate publisher from shipping malicious changes.
AI-written summary · about
chapters (12)
- 0:00SLSA and CI security intro
- 3:29What SLSA is and goals
- 7:02SLSA levels and requirements
- 10:14Build systems for SLSA levels
- 13:03SLSA level 0 to 1
- 14:28SLSA level 2 and signing
- 15:31SLSA level 3 and builds
- 16:55Generating SLSA attestations
- 19:03Verifying SLSA attestations
- 21:49SLSA dependency limits
- 23:12Secure CI fundamentals
- 26:21Summary
related talks
40mSLSA with Us: The Dance of AppSec
14mSLSA - A supply chain security framework
42mLessons Learned from Automating SLSA-Compliance Evaluation
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
15mAn Overview on SLSA
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
20mReducing the Risk of Source Tampering With SLSA
59mIntroduction to SLSA