Ketchup, Mustard, and Relish...
summary
Salsa reaches version 1.0 (April) with a focused build track and three build levels emphasizing provenance generation, attestation, and isolation; Fresca implements a secure factory reference using Tekton Chains, Sigstore/Spire and other OSS tools to produce reproducible builds; S2C2F targets consumers with controls, recently added audit controls and a hackathon-built GitHub Actions attestation that emits machine-readable evidence; Guac is at 0.1.x beta, ingesting SBOMs, deps.dev and scorecards into a queryable graph to find affected artifacts when a trust source is compromised.
AI-written summary · about
chapters (18)
- 0:00OpenSSF Supply Chain Integrity WG intro
- 7:25Panelist introductions
- 9:51SALSA overview and purpose
- 10:58Fresca secure software factory
- 11:41S2C2F secure supply chain
- 12:23GUAC artifact composition
- 13:29SALSA deep dive for devs
- 14:32SALSA compliance role
- 15:40S2C2F vs SALSA comparison
- 17:47S2C2F compliance balance
- 19:35Status of SALSA after version 1.0 release
- 21:43SALSA versioning changes
- 25:37SALSA future challenges
- 28:48SALSA security accessibility
- 33:16S2C2F framework status
- 35:20GUAC progress update
- 38:10Get involved with OpenSSF
- 39:37Upcoming SALSA tech talk
related talks
40mKetchup, Mustard, and Relish...
46mPanel Discussion: Ketchup, Mustard, and Relish of Software Supply Chain Security
40mImproving Supply Chain Integrity with Ope...
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
40mFresh SLSA and GUAC Starts with Knowing Your Ingredients
44mImproving the Software Supply Chain Security
29mMake Your CI More Secure and Less Spicy with SLSA
37mEliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...