An Overview on SLSA
summary
SLSA defines four numbered levels (1–4) with concrete requirements: level 1 produces unsigned provenance; level 2 moves checks into the build service; level 3 requires isolated build environments; level 4 adds multi-party approval and verifiable reproducible builds. The system relies on cryptographic SLSA provenance format attestations, an admission controller/policy checker that enforces policies (example: only images built by Zuul from the fetcher Docker GitHub repo and a specific job are allowed), and a two-reviewer requirement to stop injected commits.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:23Supply Chain Overview
- 0:45What is SLSA?
- 1:48SLSA Levels
- 2:40What is tampering?
- 3:18How?
- 4:46SLSA Trust Boundaries
- 5:29Gremlins in the supply chain
- 6:28Vax Trial Analysis runs evil fetcher
- 6:42SLSA to the rescue!
- 7:17Implicit Policy Checks
- 7:49Explicit policy
- 10:47SLSA saves the day!
- 11:44Gremlin housekeeping attack
- 12:22SLSA does it again!
- 13:34SLSA Level 1
- 14:29What's cooking
related talks
14mSLSA - A supply chain security framework
31mSLSA Conformance
40mSLSA with Us: The Dance of AppSec
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
59mIntroduction to SLSA
29mMake Your CI More Secure and Less Spicy with SLSA
20mReducing the Risk of Source Tampering With SLSA
22mFrom Mild To Wild: How Hot Can Your SLSA Be?