Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

SLSA Compliance

Supply-chain Levels for Software Artifacts


Overview

SLSA (Supply-chain Levels for Software Artifacts, pronounced “salsa”) is a security framework developed by Google to prevent supply chain attacks. It defines a series of incrementally adoptable security levels (0-3) that provide increasing supply chain security guarantees.

Bindy’s SLSA Status:Level 3 (highest level)


SLSA Requirements by Level

RequirementLevel 1Level 2Level 3Bindy Status
Source - Version controlled✅ Git (GitHub)
Source - Verified history✅ Signed commits
Source - Retained indefinitely✅ GitHub (permanent)
Source - Two-person reviewed✅ 2+ PR approvals
Build - Scripted build✅ Cargo + Docker
Build - Build service✅ GitHub Actions
Build - Build as code✅ Workflows in Git
Build - Ephemeral environment✅ Fresh runners
Build - Isolated✅ No secrets accessible
Build - Hermetic⚠️ Partial (cargo fetch)
Build - Reproducible✅ Bit-for-bit
Provenance - Available✅ SBOM + signatures
Provenance - Authenticated✅ Signed tags
Provenance - Service generated✅ GitHub Actions
Provenance - Non-falsifiable✅ Cryptographic signatures
Provenance - Dependencies complete✅ Cargo.lock + SBOM

SLSA Level 3 Detailed Compliance

Source Requirements

✅ Requirement: Version controlled with verified history

ControlImplementationEvidence
Git Version ControlAll source code in GitHubGitHub repository
Signed CommitsAll commits GPG/SSH signedgit log --show-signature
Verified HistoryBranch protection prevents history rewritingGitHub branch protection
Two-Person Review2+ approvals required for all PRsPR approval logs
Permanent RetentionGit history never deletedGitHub repository settings

Evidence:

# Show all commits are signed (last 90 days)
git log --show-signature --since="90 days ago" --oneline

# Show branch protection (prevents force push, history rewriting)
gh api repos/firestoned/bindy/branches/main/protection | jq

Build Requirements

✅ Requirement: Build process is fully scripted and reproducible

ControlImplementationEvidence
Scripted BuildCargo (Rust), Docker (containers)Cargo.toml, Dockerfile
Build as CodeGitHub Actions workflows in version control.github/workflows/*.yaml
Ephemeral EnvironmentFresh GitHub-hosted runners for each buildGitHub Actions logs
IsolatedBuild cannot access secrets or network (after deps fetched)GitHub Actions sandboxing
Hermetic⚠️ Partial - cargo fetch uses networkWorking toward full hermetic
ReproducibleTwo builds from same commit = identical binaryBuild Reproducibility

Build Reproducibility Verification:

# Automated verification (daily CI/CD)
# Builds binary twice, compares SHA-256 hashes
.github/workflows/reproducibility-check.yaml

# Manual verification (external auditors)
scripts/verify-build.sh v0.1.0

Sources of Non-Determinism (Mitigated):

  1. Timestamps → Use vergen for deterministic Git commit timestamps
  2. Filesystem order → Sort files before processing
  3. HashMap iteration → Use BTreeMap for deterministic order
  4. Parallelism → Sort output after parallel processing
  5. Base image updates → Pin base image digests in Dockerfile

Evidence:


Provenance Requirements

✅ Requirement: Build provenance is available, authenticated, and non-falsifiable

ArtifactProvenance TypeSignatureAvailability
Rust BinarySHA-256 checksumGPG-signed Git tagGitHub Releases
Container ImageImage digestSBOM + attestationGHCR (GitHub Container Registry)
SBOMCycloneDX formatIncluded in releaseGitHub Releases (*.sbom.json)
Source CodeGit commitGPG/SSH signatureGitHub repository

SBOM Generation:

# Generate SBOM (Software Bill of Materials)
cargo install cargo-cyclonedx
cargo cyclonedx --format json --output bindy.sbom.json

# SBOM includes all dependencies with exact versions
cat bindy.sbom.json | jq '.components[] | {name, version}'

Evidence:

  • GitHub Releases: https://github.com/firestoned/bindy/releases
  • SBOM files: bindy-*.sbom.json in release artifacts
  • Signed Git tags: git tag --verify v0.1.0
  • Container image signatures: docker trust inspect ghcr.io/firestoned/bindy:v0.1.0

SLSA Build Levels Comparison

AspectLevel 1Level 2Level 3Bindy
Protection againstAccidental errorsCompromised build serviceCompromised source + build✅ All
Source integrityManual commitsSigned commitsSigned commits + 2-person review✅ Complete
Build integrityManual buildAutomated buildReproducible build✅ Complete
ProvenanceNoneService-generatedCryptographic provenance✅ Complete
VerifiabilityTrust on first useVerifiable by serviceVerifiable by anyone✅ Complete

SLSA Compliance Roadmap

RequirementStatusEvidence
Level 1✅ CompleteGit, Cargo build
Level 2✅ CompleteGitHub Actions, signed commits, SBOM
Level 3 (Source)✅ CompleteSigned commits, 2+ PR approvals, permanent Git history
Level 3 (Build)✅ CompleteReproducible builds, verification script
Level 3 (Provenance)✅ CompleteSBOM, signed tags, container attestation
Level 3 (Hermetic)⚠️ Partialcargo fetch uses network (working toward offline builds)

Verification for End Users

How to verify Bindy releases:

# 1. Verify Git tag signature
git verify-tag v0.1.0

# 2. Rebuild from source
git checkout v0.1.0
cargo build --release --locked

# 3. Compare binary hash with released artifact
sha256sum target/release/bindy
curl -sL https://github.com/firestoned/bindy/releases/download/v0.1.0/bindy-linux-amd64.sha256

# 4. Verify SBOM (Software Bill of Materials)
curl -sL https://github.com/firestoned/bindy/releases/download/v0.1.0/bindy.sbom.json | jq .

# 5. Verify container image signature (if using containers)
docker trust inspect ghcr.io/firestoned/bindy:v0.1.0

Expected Result: ✅ All verifications pass, hashes match, provenance verified


SLSA Threat Mitigation

ThreatSLSA LevelBindy Mitigation
A: Build system compromiseLevel 2+✅ GitHub-hosted runners (ephemeral, isolated)
B: Source code compromiseLevel 3✅ Signed commits, 2+ PR approvals, branch protection
C: Dependency compromiseLevel 3✅ Cargo.lock pinned, daily cargo audit, SBOM
D: Upload of malicious binariesLevel 2+✅ GitHub Actions uploads, not manual
E: Compromised build configLevel 2+✅ Workflows in Git, 2+ PR approvals
F: Use of compromised packageLevel 3✅ Reproducible builds, users can verify

See Also