Lessons Learned from Automating SLSA-Compliance Evaluation
summary
Automated evaluation of SLSA across Jenkins/Kubernetes and GitHub Actions collects logs and API data to produce minimal provenance (typically Builder ID and build type), and a small open toolchain (the git-gat project) generates continuous GitHub posture reports. Level 2 is trivial, level 3 is achievable with hosted runners, fresh pods, MFA enforcement and branch protections but requires tailored checks, and level 4’s hermetic requirement to pin all transitive dependencies is impractical. A fake git experiment shows pipeline logs can be falsified, so prefer service‑generated data or signing.
AI-written summary · about
chapters (27)
- 0:00Intro
- 1:18Agenda Storyline
- 3:51SLSA Overview
- 5:21Provenance: Evidence Based Trust
- 6:41Our Pipelines
- 8:29Pipeline Dynamics
- 10:09First Steps: SLSA L1
- 10:27No Brainer
- 11:29The Requirements
- 12:52Compliance
- 13:20Provenance Authenticity Options
- 16:32Sample log files
- 16:47Anecdote: Not All Logs Created Equal
- 17:27Anecdote: Logs and Immutable Reference
- 18:19SLSA L1+L2 Evaluation Automation
- 22:31Source-Verified
- 24:18SLSA Source - Retained Indefinitely Req.
- 26:02SLSA L3 Source Reqs Options
- 27:34SLSA L3 Ephemeral & Isolation Challenge
- 29:05Implementing SLSA L3 Ephemeral & Isolation
- 31:02Evaluation of Ephemeral & Isolation Reqs.
- 32:02SLSA L3 - Provenance - Non-Falsifiable
- 33:05Demo: Untrusted log
- 33:49Unfalsifiable Provenance
- 37:32Build Parameterless & Hermetic
- 38:12Defeated by SLSA L4
- 38:57Takeaways
related talks
29mMake Your CI More Secure and Less Spicy with SLSA
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
40mSLSA with Us: The Dance of AppSec
59mIntroduction to SLSA
15mAn Overview on SLSA
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
14mSLSA - A supply chain security framework
24mThe State of Git Security With SLSA and Gittuf