SLSA masterclasses

In the first masterclass, we talked about the need for software supply chain security, introduced the core concepts of SLSA, and showed how an existing build platform (GitHub) enables this through a demonstration of provenance generation and verification.

In this second session, we will take a closer look at a specific threat scenario - that of building from a source code that has been unauthorizedly modifed in transit (Threat C in SLSA documentation), or a compromised build process (Threat E in SLSA documentation). We describe this attack and real-world examples briefly in the introduction section.

We then show that without the proper security in place, how the attack succeeds. Next we show that with SLSA implemented properly, the latter stages of the CI/CD pipeline detects the issue and aborts.

This would be a good guide to developers who want an example of “SLSA as intended”.