Google Online Security Blog: How to SLSA Part 3

Security Blog

The latest news and insights from Google on security and safety on the Internet

How to SLSA Part 3 - Putting it all together

14. April 2022

Posted by Tom Hennen, software engineer, BCID & GOSST
12

The Squirrel package ‘foo’

The Oppy package ‘baz’

A custom executable, ‘bar’, written by Acme employees.

source attestation

bar is compiled from source code stored in the same source repo as the Dockerfile.

acorn install downloads ‘foo’ from the Squirrel repo, verifying the VSA, and recording the use of acorn://foo@abc and its VSA in the build.

acme_oppy_get install (a custom script made by Acme) downloads the latest version of the Oppy ‘baz’ package and queries its SLSA provenance and other attestations from Rekor. It then performs a full verification checking that it was built by ‘https://oppy.example/slsa/builder/v1’ and the publicized key. Once verification is complete it records the use of oppy://baz@def and the associated attestations in the build.

The build process assembles the SLSA provenance for the container by:

Recording the Acme git repo the bar source and Dockerfile came from, into materials.
Copying the reported dependencies of acorn://foo@abc and oppy://baz@def into materials and adding their attestations to the output in-toto bundle.
Recording the CI/CD entrypoint as the invocation.
Creating a signed DSSE with the SLSA provenance and adding it to the output in-toto bundle.