An Overview on SLSA

Explore a comprehensive overview of SLSA (Supply-chain Levels for Software Artifacts) in this informative conference talk presented by Tom Hennen from Google and Joshua Lock from VMware. Dive into the methodology designed to prevent tampering with the software supply chain, following the journey of mischievous gremlins attempting to introduce malicious code into a widely-used container image. Learn how SLSA controls effectively raise the cost of attacks at each step of the supply chain, thwarting potential threats. Discover the concept of SLSA levels, trust boundaries, and both implicit and explicit policy checks. Through engaging examples and scenarios, gain insights into how SLSA safeguards against various attack vectors, including housekeeping attacks. Conclude with an introduction to SLSA Level 1 and a glimpse into future developments in supply chain security.