Главная
Study mode:
on
1
Intro
2
Agenda Storyline
3
SLSA Overview
4
Provenance: Evidence Based Trust
5
Our Pipelines
6
Pipeline Dynamics
7
First Steps: SLSA L1
8
No Brainer
9
The Requirements
10
Compliance
11
Provenance Authenticity Options
12
Sample log files
13
Anecdote: Not All Logs Created Equal
14
Anecdote: Logs and Immutable Reference
15
SLSA L1+L2 Evaluation Automation
16
Source-Verified
17
SLSA Source - Retained Indefinitely Req.
18
SLSA L3 Source Reqs Options
19
SLSA L3 Ephemeral & Isolation Challenge
20
Implementing SLSA L3 Ephemeral & Isolation
21
Evaluation of Ephemeral & Isolation Reqs.
22
SLSA L3 - Provenance - Non-Falsifiable
23
Demo: Untrusted log
24
Unfalsifiable Provenance
25
Build Parameterless & Hermetic
26
Defeated by SLSA L4
27
Takeaways
Description:
Explore the challenges and insights gained from automating SLSA-compliance evaluation in this 42-minute conference talk by Daniel Nebenzahl from Scribe-security. Delve into the SLSA framework, focusing on provenance and evidence-based trust. Examine pipeline dynamics and the initial steps towards SLSA Level 1 compliance. Discover the complexities of log file management and the importance of immutable references. Learn about the automation process for SLSA Levels 1 and 2 evaluation, including source verification and retention requirements. Investigate the challenges of implementing SLSA Level 3, particularly regarding ephemeral environments and isolation. Witness a demonstration of untrusted logs and unfalsifiable provenance. Conclude with key takeaways on build parameterlessness, hermeticity, and the path to SLSA Level 4 compliance.

Lessons Learned from Automating SLSA-Compliance Evaluation

Linux Foundation
Add to list
0:00 / 0:00