Vol. II
Securing CI/CD & the Software Supply Chain
SLSA, SBOM, Sigstore and the pipelines attackers target most
§ 01, Do que trata
Covers the pipeline as an attack surface: SLSA levels, SBOM and VEX, keyless signing with Sigstore, and the build-time attack patterns from SolarWinds to XZ Utils. Written from the SAST/DAST gates on several critical applications and the SBOM generation in the pipelines I work on today.
§ 02, O que quero que o leitor consiga fazer
- 01
Say which SLSA level a pipeline is at and what the next one requires.
- 02
Sign and attest an artifact, and refuse an unsigned one at deploy time.
- 03
Produce an SBOM an auditor can read and a VEX statement for the findings that do not apply.
§ 03, O diagrama ao qual eu sempre volto
Rola para o lado →
§ 04, Estrutura planejada
- Parte I
The pipeline attack surface
A taxonomy of supply-chain attacks, from SolarWinds to XZ Utils, and the trust-boundary map to draw before adding controls.
- Parte II
SLSA: from theory to pipeline config
What each SLSA level requires of the build, and what changes in the pipeline configuration to get there.
- Parte III
Artifact signing and transparency
Keyless signing and a transparency log, and the policy check that refuses an unsigned artifact at deploy time.
- Parte IV
SBOM, VEX and dependency management
SBOM formats and when each fits, VEX for the findings that do not apply, and dependency updates that do not break production.
§ 05, Quando der para ler