Skip to content

slsa.md

Latest commit

 

History

History
68 lines (47 loc) · 2.65 KB

slsa.md

File metadata and controls

68 lines (47 loc) · 2.65 KB
Raw

SLSA Build L3 target

shitpost targets SLSA Build L3 for release artifacts produced by GitHub Actions.

SLSA compliance is artifact-specific. A pipeline is not simply "SLSA compliant"; each released artifact needs provenance that consumers can verify against expected source, workflow, and builder identities.

The broader release-security plan is in release-security-plan.md. Start there for OWASP release hardening work; this document covers the SLSA-specific part.

What Build L3 means

SLSA Build L3 requires:

  • A consistent, documented build process.
  • Provenance for the released artifact, bound to the artifact digest.
  • Signed provenance generated by a hosted build platform.
  • Hardened build isolation so build steps cannot forge provenance signing material or influence other builds.
  • A distribution and verification path for consumers.

Current implementation

Release archives:

  • Built by GoReleaser in .github/workflows/release.yml.
  • Checksummed by GoReleaser in checksums.txt.
  • Attested by slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0.
  • Provenance is uploaded to the GitHub release.

GHCR container image:

  • Built on GitHub-hosted runners by Docker Buildx in .github/workflows/release.yml.
  • Published to ghcr.io/bupd/shitpost by digest.
  • Signed keylessly with cosign.
  • Attested by slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0.

Verify release archives

Install slsa-verifier, download a release asset plus its .intoto.jsonl provenance, then run:

slsa-verifier verify-artifact ./shitpost_<version>_linux_amd64.tar.gz \
  --provenance-path ./multiple.intoto.jsonl \
  --source-uri github.com/bupd/shitpost \
  --source-tag <version>

Verify GHCR container provenance

Install slsa-verifier, then run:

slsa-verifier verify-image ghcr.io/bupd/shitpost:<version> \
  --source-uri github.com/bupd/shitpost \
  --source-tag <version>

Also verify the image signature:

cosign verify ghcr.io/bupd/shitpost:<version> \
  --certificate-identity-regexp '^https://github.com/bupd/shitpost/.github/workflows/release.yml@refs/tags/v[0-9]+\\.[0-9]+\\.[0-9]+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Remaining gaps

  • Pin third-party Actions by immutable SHA where compatible. The SLSA reusable workflows must remain semver-tagged for verifier compatibility.
  • Add branch/tag protection rules in GitHub settings so releases only come from reviewed code and protected tags.
  • Add a release smoke test that verifies a freshly published artifact and image with slsa-verifier.