SLSA with Us: The Dance of AppSec
summary
SLSA Build 1.0 enforces provenance for source-to-artifact builds and defines three levels: L1 exists provenance, L2 signed provenance, L3 unforgeable per-build signing plus isolation. Demo builds an npm package with a GitHub Actions reusable workflow that records a SLSA predicate, signs via sigstore Fulcio/Rekor, and publishes a transparency log entry; verification scripts check attestation hash, builder ID and provenance path. Claim: focus on builds fixes missing provenance and makes detection and policy enforcement practical.
AI-written summary · about
chapters (4)
related talks
14mSLSA - A supply chain security framework
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
29mMake Your CI More Secure and Less Spicy with SLSA
15mAn Overview on SLSA
23mDirty Dancing - Untrustworthy SLSA Build Provenance
46mHow to Secure Your Software Supply Chain with SLSA, Sigstore and Kyverno
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
20mReducing the Risk of Source Tampering With SLSA