Vol. II
Securing CI/CD & the Software Supply Chain
SLSA, SBOM, Sigstore and the pipelines attackers target most
§ 01, What it's about
Covers the pipeline as an attack surface: SLSA levels, SBOM and VEX, keyless signing with Sigstore, and the build-time attack patterns from SolarWinds to XZ Utils. Written from the SAST/DAST gates on several critical applications and the SBOM generation in the pipelines I work on today.
§ 02, What I want the reader to be able to do
- 01
Say which SLSA level a pipeline is at and what the next one requires.
- 02
Sign and attest an artifact, and refuse an unsigned one at deploy time.
- 03
Produce an SBOM an auditor can read and a VEX statement for the findings that do not apply.
§ 03, The diagram I keep coming back to
Scrolls sideways →
§ 04, Planned structure
- Part I
The pipeline attack surface
A taxonomy of supply-chain attacks, from SolarWinds to XZ Utils, and the trust-boundary map to draw before adding controls.
- Part II
SLSA: from theory to pipeline config
What each SLSA level requires of the build, and what changes in the pipeline configuration to get there.
- Part III
Artifact signing and transparency
Keyless signing and a transparency log, and the policy check that refuses an unsigned artifact at deploy time.
- Part IV
SBOM, VEX and dependency management
SBOM formats and when each fits, VEX for the findings that do not apply, and dependency updates that do not break production.
§ 05, When it's readable