#slsa — Public Fediverse posts

RE: https://mastodon.social/@7ASecurity/116521920390604616

💪 “urllib3's supply chain posture was described as exceptionally strong, with advanced compliance across SLSA Source, Build, and Provenance requirements. The project maintainers were helpful, responsive, and engaged throughout the audit, ensuring that 7ASecurity had the necessary access and information at all times”

Excellent work @illiav and @quentinpradet! 👏

#security #python #opensource #oss #supplychain #slsa

@slink

https://slsa.dev/

#slsa is the standard

I had to deal a bit with the "Supply-chain Levels for Software Artifacts" (SLSA) "standard":
https://slsa.dev/

IMO it's a joke, since they do not properly deal with threats from "Includ[ing] a vulnerable dependency (library, base image, bundled file, etc.)". They essentially say "A future version of this standard might deal with that":
https://slsa.dev/spec/v1.2/threats

This has been the main entry point of the past supply chain attacks (XZ backdoor, litellm, Shai-Hulud, ...). A supply-chain security standard that doesn't properly deal with vulnerabilities in dependencies completely misses the point. It's like installing alarms on your windows (to catch burglars trying to enter your home through the windows) when your front door doesn't have a lock.

#SLSA #supplychain #supplychainsecurity #xzbackdoor #ShaiHulud #litellm

I had to deal a bit with the "Supply-chain Levels for Software Artifacts" (SLSA) "standard":
https://slsa.dev/

IMO it's a joke, since they do not properly deal with threats from "Includ[ing] a vulnerable dependency (library, base image, bundled file, etc.)". They essentially say "A future version of this standard might deal with that":
https://slsa.dev/spec/v1.2/threats

This has been the main entry point of the past supply chain attacks (XZ backdoor, litellm, Shai-Hulud, ...). A supply-chain security standard that doesn't properly deal with vulnerabilities in dependencies completely misses the point. It's like installing alarms on your windows (to catch burglars trying to enter your home through the windows) when your front door doesn't have a lock.

#SLSA #supplychain #supplychainsecurity #xzbackdoor #ShaiHulud #litellm

I had to deal a bit with the "Supply-chain Levels for Software Artifacts" (SLSA) "standard":
https://slsa.dev/

IMO it's a joke, since they do not properly deal with threats from "Includ[ing] a vulnerable dependency (library, base image, bundled file, etc.)". They essentially say "A future version of this standard might deal with that":
https://slsa.dev/spec/v1.2/threats

This has been the main entry point of the past supply chain attacks (XZ backdoor, litellm, Shai-Hulud, ...). A supply-chain security standard that doesn't properly deal with vulnerabilities in dependencies completely misses the point. It's like installing alarms on your windows (to catch burglars trying to enter your home through the windows) when your front door doesn't have a lock.

#SLSA #supplychain #supplychainsecurity #xzbackdoor #ShaiHulud #litellm

I had to deal a bit with the "Supply-chain Levels for Software Artifacts" (SLSA) "standard":
https://slsa.dev/

IMO it's a joke, since they do not properly deal with threats from "Includ[ing] a vulnerable dependency (library, base image, bundled file, etc.)". They essentially say "A future version of this standard might deal with that":
https://slsa.dev/spec/v1.2/threats

This has been the main entry point of the past supply chain attacks (XZ backdoor, litellm, Shai-Hulud, ...). A supply-chain security standard that doesn't properly deal with vulnerabilities in dependencies completely misses the point. It's like installing alarms on your windows (to catch burglars trying to enter your home through the windows) when your front door doesn't have a lock.

#SLSA #supplychain #supplychainsecurity #xzbackdoor #ShaiHulud #litellm

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “METAR SLSA 301300Z 12003KT 9999 FEW007 BKN080 26/24 Q1015” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacumaairport #airport #santaanadelyacuma #bolivia #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “METAR SLSA 301300Z 12003KT 9999 FEW007 BKN080 26/24 Q1015” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacumaairport #airport #santaanadelyacuma #bolivia #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “METAR SLSA 301300Z 12003KT 9999 FEW007 BKN080 26/24 Q1015” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacumaairport #airport #santaanadelyacuma #bolivia #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “METAR SLSA 301300Z 12003KT 9999 FEW007 BKN080 26/24 Q1015” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacumaairport #airport #santaanadelyacuma #bolivia #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “METAR SLSA 301300Z 12003KT 9999 FEW007 BKN080 26/24 Q1015” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacumaairport #airport #santaanadelyacuma #bolivia #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Supply Chain Security на примере кофемашины: почему ваш код горчит

Привет, Хабр! Меня зовут Максим Князев, старший системный инженер К2 Кибербезопасность . Сегодня я хочу поговорить об атаках на цепочки поставок на примере того, что все хорошо понимают и любят. Просто представьте, как вы заказываете эспрессо в проверенной кофейне. Зерна от известного обжарщика, бариста с опытом, кофемашина за миллион. И казалось бы, все идеально. Но потом выясняется, что кто-то подсыпал в зерна что-то лишнее еще на плантации. Вы не виноваты, кофейня не виновата, но пить это вы уже не хотите. В разработке происходит ровно то же самое, только в роли зерен здесь выступают npm-пакеты. Плантация превращается в GitHub, а подозрительные примеси представляют собой вредоносный код в легитимном релизе. И вы узнаете о проблемах не по вкусу, а по инциденту в проде. Давайте продолжим это сравнение под катом и разберемся, как не испортить компоненты, из которых складывается современная кибербезопасность.

https://habr.com/ru/companies/k2tech/articles/1004536/

#supply_chain_security #безопасность_цепочки_поставок #sbom #devsecops #open_source #npm #кибербезопасность #уязвимости #slsa #разработка_по

Supply Chain Security на примере кофемашины: почему ваш код горчит

Привет, Хабр! Меня зовут Максим Князев, старший системный инженер К2 Кибербезопасность . Сегодня я хочу поговорить об атаках на цепочки поставок на примере того, что все хорошо понимают и любят. Просто представьте, как вы заказываете эспрессо в проверенной кофейне. Зерна от известного обжарщика, бариста с опытом, кофемашина за миллион. И казалось бы, все идеально. Но потом выясняется, что кто-то подсыпал в зерна что-то лишнее еще на плантации. Вы не виноваты, кофейня не виновата, но пить это вы уже не хотите. В разработке происходит ровно то же самое, только в роли зерен здесь выступают npm-пакеты. Плантация превращается в GitHub, а подозрительные примеси представляют собой вредоносный код в легитимном релизе. И вы узнаете о проблемах не по вкусу, а по инциденту в проде. Давайте продолжим это сравнение под катом и разберемся, как не испортить компоненты, из которых складывается современная кибербезопасность.

https://habr.com/ru/companies/k2tech/articles/1004536/

#supply_chain_security #безопасность_цепочки_поставок #sbom #devsecops #open_source #npm #кибербезопасность #уязвимости #slsa #разработка_по

Supply Chain Security на примере кофемашины: почему ваш код горчит

Привет, Хабр! Меня зовут Максим Князев, старший системный инженер К2 Кибербезопасность . Сегодня я хочу поговорить об атаках на цепочки поставок на примере того, что все хорошо понимают и любят. Просто представьте, как вы заказываете эспрессо в проверенной кофейне. Зерна от известного обжарщика, бариста с опытом, кофемашина за миллион. И казалось бы, все идеально. Но потом выясняется, что кто-то подсыпал в зерна что-то лишнее еще на плантации. Вы не виноваты, кофейня не виновата, но пить это вы уже не хотите. В разработке происходит ровно то же самое, только в роли зерен здесь выступают npm-пакеты. Плантация превращается в GitHub, а подозрительные примеси представляют собой вредоносный код в легитимном релизе. И вы узнаете о проблемах не по вкусу, а по инциденту в проде. Давайте продолжим это сравнение под катом и разберемся, как не испортить компоненты, из которых складывается современная кибербезопасность.

https://habr.com/ru/companies/k2tech/articles/1004536/

#supply_chain_security #безопасность_цепочки_поставок #sbom #devsecops #open_source #npm #кибербезопасность #уязвимости #slsa #разработка_по

Supply Chain Security на примере кофемашины: почему ваш код горчит

Привет, Хабр! Меня зовут Максим Князев, старший системный инженер К2 Кибербезопасность . Сегодня я хочу поговорить об атаках на цепочки поставок на примере того, что все хорошо понимают и любят. Просто представьте, как вы заказываете эспрессо в проверенной кофейне. Зерна от известного обжарщика, бариста с опытом, кофемашина за миллион. И казалось бы, все идеально. Но потом выясняется, что кто-то подсыпал в зерна что-то лишнее еще на плантации. Вы не виноваты, кофейня не виновата, но пить это вы уже не хотите. В разработке происходит ровно то же самое, только в роли зерен здесь выступают npm-пакеты. Плантация превращается в GitHub, а подозрительные примеси представляют собой вредоносный код в легитимном релизе. И вы узнаете о проблемах не по вкусу, а по инциденту в проде. Давайте продолжим это сравнение под катом и разберемся, как не испортить компоненты, из которых складывается современная кибербезопасность.

https://habr.com/ru/companies/k2tech/articles/1004536/

#supply_chain_security #безопасность_цепочки_поставок #sbom #devsecops #open_source #npm #кибербезопасность #уязвимости #slsa #разработка_по

From #ContainerDays London to Barcelona: big thanks to the #DevOps BCN #Meetup for having me!

I revisited my talk on moving beyond imperative #Docker builds toward #Declarative, #Reproducible and #Secure #OCI #Containers with #Nix:
Hermetic, network-isolated builds, clearer dependency graphs, better layer reuse across images, and a stronger supply-chain story (#SBOM + #SLSA provenance).

You can find the slides, transcript and more information at my website: https://www.arik-grahl.de/talks/devops-bcn-february-2026

From #ContainerDays London to Barcelona: big thanks to the #DevOps BCN #Meetup for having me!

I revisited my talk on moving beyond imperative #Docker builds toward #Declarative, #Reproducible and #Secure #OCI #Containers with #Nix:
Hermetic, network-isolated builds, clearer dependency graphs, better layer reuse across images, and a stronger supply-chain story (#SBOM + #SLSA provenance).

Slides, transcript and more information at my website: https://www.arik-grahl.de/talks/devops-bcn-february-2026

Photography by @robertspang

🚀 NEW on We ❤️ Open Source 🚀

Electric sheep need defenders. 🐑🔐 Brett Smith explores how SLSA helps secure the software supply chain, translating EO 14028 into a roadmap for resilient pipelines.

Read the article: https://allthingsopen.org/articles/supply-chain-robots-slsa-security

#WeLoveOpenSource #SLSA #FOSS #Cybersecurity #DevSecOps #PolicyAsCode

🌟 New OpenSSF Project Spotlight 💃

In this interview, SLSA Steering Committee member Tom Hennen (Google) breaks down how SLSA is helping organizations strengthen trust across the software supply chain.

Watch the full Project Spotlight:
🔗 https://www.youtube.com/watch?v=gdYlSuH5Srs

#OpenSSF #SLSA #OSSSecurity

🚨 The AI wave is here, and with it comes a new cybersecurity battleground.

Discover how open source tools like #Sigstore, and #SLSA-based frameworks can help close these gaps and build more resilient AI systems.

Read the blog and learn how to get involved: https://openssf.org/blog/2025/08/12/securing-ai-the-next-cybersecurity-battleground/

New to OpenSSF or thinking about getting involved? We've got you. 💡

This blog by Ejiro and Sal introduces all our working groups, tools, and projects like #sigstore, #SLSA, and #OpenSSFScorecard.

Start here 👉 https://openssf.org/blog/2025/08/08/from-beginner-to-builder-understanding-openssf-community-and-working-groups/

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “SLSA 041100Z 12004KT 9999 SCT004 SCT070 25/24 Q1013” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacuma #bolivia #santaanadelyacumaairport #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “SLSA 041100Z 12004KT 9999 SCT004 SCT070 25/24 Q1013” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacuma #bolivia #santaanadelyacumaairport #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “SLSA 041100Z 12004KT 9999 SCT004 SCT070 25/24 Q1013” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacuma #bolivia #santaanadelyacumaairport #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “SLSA 041100Z 12004KT 9999 SCT004 SCT070 25/24 Q1013” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacuma #bolivia #santaanadelyacumaairport #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Santa Ana Del Yacuma airport (Bolivia) is “SLSA 041100Z 12004KT 9999 SCT004 SCT070 25/24 Q1013” : See what it means on https://www.bigorre.org/aero/meteo/slsa/en #santaanadelyacuma #bolivia #santaanadelyacumaairport #slsa #sbl #metar #aviation #aviationweather #avgeek vl

Join Harsh Thakur (Civo) & Saiyam Pathak (Loft Labs) as they talk about practical steps for achieving #SLSA compliance:

✔️ Generating SBOMs & provenance
✔️ Keyless attestations with cosign
✔️ Hermetic builds with Buildkit

📍 #SOSSCommunity Day India

Join Harsh Thakur (Civo) & Saiyam Pathak (Loft Labs) as they talk about practical steps for achieving #SLSA compliance:

✔️ Generating SBOMs & provenance
✔️ Keyless attestations with cosign
✔️ Hermetic builds with Buildkit

📍 #SOSSCommunity Day India

Join Harsh Thakur (Civo) & Saiyam Pathak (Loft Labs) as they talk about practical steps for achieving #SLSA compliance:

✔️ Generating SBOMs & provenance
✔️ Keyless attestations with cosign
✔️ Hermetic builds with Buildkit

📍 #SOSSCommunity Day India

Join Harsh Thakur (Civo) & Saiyam Pathak (Loft Labs) as they talk about practical steps for achieving #SLSA compliance:

✔️ Generating SBOMs & provenance
✔️ Keyless attestations with cosign
✔️ Hermetic builds with Buildkit

📍 #SOSSCommunity Day India

Join Harsh Thakur (Civo) & Saiyam Pathak (Loft Labs) as they talk about practical steps for achieving #SLSA compliance:

✔️ Generating SBOMs & provenance
✔️ Keyless attestations with cosign
✔️ Hermetic builds with Buildkit

📍 #SOSSCommunity Day India

🌈 👩‍⚖️ 👨‍💼 ‍💼 🌈 Very pleased to see this in print! The outcome of research by Steven Vaughan, Ben Weil and I on the experiences of LGBT+/Queer barristers within the heteronormative and masculinist environment of the Bar of England and Wales. What seems to be at stake in being an 'out' professional, how that gets navigated, and what it might cost. The possible forms of Professionalism: Credibility and the performance of queer sexualities among barristers in England and Wales. https://doi.org/10.1111/jols.12408

#lgbt #queer #lawyers #barristers #professionalism #lgbthistorymonth #sociolegal #slsa

Types of Security Audits: Overview and Best Practices – Source: securityboulevard.com https://ciso2ciso.com/types-of-security-audits-overview-and-best-practices-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #Risk&Compliance #BestPractices #Compliance #Explainers #Governance #threats #AppSec #SLSA

Wondering whether users of #cosign (by #sigstore) and #slsa (slsa-verifier) would have opinions on how to best make use of these verification tools when downloading binaries for use in container images?

I started a StackOverflow discussion here with more details, since I'm new to playing around with these toolchains:

https://stackoverflow.com/beta/discussions/78962951/when-using-tools-like-slsa-verifier-and-cosign-how-do-you-verify-the-verifiers

My #OSHcamp presentation for those struggling with the screen https://www.slideshare.net/slideshow/showing-that-you-care-about-security-for-your-open-source-hardware-project/271275092

#sbom #slsa #openssf #scorecard

@dolmen Many systems are based on #bootstrapping and #reproducableBuilds
• https://bootstrappable.org/
• https://reproducible-builds.org/
• https://en.wikipedia.org/wiki/Bootstrapping_(compilers)

These ensure that the build system integrity cannot be tampered with. One example of such system is https://openbuildservice.org/

Here's a great read on the topic from #SUSE : https://documentation.suse.com/sbp/server-linux/html/SBP-SLSA4/

Generally Supply-chain Levels for Software Artifacts (#SLSA) framework is a great resource on this topic: https://slsa.dev/ #cybersecurity #infosec

slsa-github-generator v2 now uses upload/download-artifact v4, so I can update those in all the Pallets projects. Turns out the publish workflow for most projects didn't need any changes at all. Only MarkupSafe, with multiple build jobs, needed a little change to use different upload names and combine their downloads. https://github.com/pallets/markupsafe/commit/f4905079ef7573d5c1e8fe1f291f1e353050bc87 #Python #Flask #MarkupSafe #GitHub #SLSA

To explain, we have #SLSA signatures that verify the build was done automatically by #GitHub as instructed, *and* we have traditional #gpg signatures with private keys only known to maintainer(s) that verify a maintainer actually triggered the built and locally reproduced it…
Given they both validate, you automatically achieve reproducible builds _and_ #SLSA validity.

One caveat: This was only easy, because our build process is essentially one command (git archive).

https://github.com/PrivateBin/PrivateBin/blob/master/doc/Release.md

The way this works, is, essentially, quite easy: the whole build process is documented in the same repository, builds are automated via CI/CD and all that is, to reach best support, done in an environment that prevents tampering and (crucially) is *out of your control*.

Then you get #SLSA v3: https://slsa.dev/get-started#slsa-3 (quite easy with GitHub Actions)

Note on all the #xz drama, there are some technical solutions for such #supplychainattack that can make such an attack way harder, at least to hide the code in tarballs etc.

https://slsa.dev/ e.g. is a solution. Combined with reproducible builds, it ensures that a software artifact is built exactly from the source given in a source repository, with the possibility to prove that and no way for any maintainer to tamper with (in the highest level).

#slsa #infosec #security #linux #backdoor

I've decided to try my hand at speaking at IT Security conferences: I've got one rejected CFP so far, but today I proposed another for BSides Boulder:

"Preventing SolarWinds 2.0: #SLSA isn't gonna save you".

#Adoptium has finalised the releases of the January #Temurin #openjdk updates - jdk 8u402, 11.0.22, 17.0.10 and 21.0.2.
This is the first JDK21 release to include AIX and Linux/s390x platforms, and the release is #SLSA build level 3 compliant on Linux and macOS platforms.
https://adoptium.net/blog/2024/01/eclipse-temurin-8u402-11022-1710-and-2102-available/

Beach safety for humans in a more-than-human world
Have drones at the beach, repel birds

Beachgoers are warned with larges signs of a drone operating at Sawtell beach. The warning posters for the aerial operations states that they have the rationale to keep human beings safe. The unmanned aerial vehicle makes an irritating buzzing sound while flying over the heads of beachgoers.

The beauty of Sawtell beach is usually to share the ambience with shorebirds, birds of prey and little terns. With the loud gadget droning up and down the beach no bird or endangered shorebird was visible or audible. The scarecrow in the sky, the jet skis and car on the sand make sure the beach is just for one species alone.

Drones are disturbing critically endangered shorebirds in Moreton Bay, creating a domino effect
https://theconversation.com/drones-are-disturbing-critically-endangered-shorebirds-in-moreton-bay-creating-a-domino-effect-209391

Human safety, The Civil Aviation Safety Authority
https://www.casa.gov.au/knowyourdrone

Sawtell - Threatened Shorebirds. The Threatened Shorebirds program shares the plight of these incredible shorebirds, including Little terns, Pied oyster catchers and Beach stone curlews
https://www.coffsharbour.nsw.gov.au/Eventbrite/Threatened-Shorebirds-767985383957

#Sawtell #SawtellBeach #UAVs #regulation #drones #gadgets #CASA #SLSA #SurfLifeSaving #safety #IndustrialisedBeaches #birds #Shorebirds #ThreatenedShorebirds #wildlife #ShareTheBeach

If I could pick one software supply chain security thing for people to look at in the new year, it would be the Secure Supply Chain Consumption Framework. It describes in detail how to manage risk associated with software dependencies.

I consider this more important than SBOMs or SLSA.

Check it out! https://github.com/ossf/s2c2f

#sbom #slsa #s2c2f

#SLSA: #Macaron is an extensible supply chain security analysis framework from Oracle which integrates with existing #SBOM in OWASP #CycloneDX

#SoftwareSupplyChainSecurity

👇
https://github.com/oracle/macaron

My colleague Scott Fryer gave a talk at this year's @EclipseFdn 's #EclipseCon on #Adoptium's secure development practices, what we've done and what we're going to do going forward. It covers #SLSA, #SSDF, #SBoM, binary #reproducibleBuilds and keeping a heterogeneous #openSource project's infrastructure secure with #Wazuh

If some of those buzzwords have piqued your interest (or you want to know what they are) checkout his video: https://www.youtube.com/watch?v=mpEKUnX84UQ
#secureDev #CycloneDX

Je commence par un talk sur #SLSA, #Sigstore et #Kyverno, présenté par Mohamed Abdennebi (Sfeir).

J'ai beaucoup aimé ce talk parce que ça m'a donné *enfin* un bon exposé sur la théorie (les différentes briques à mettre en œuvre pour monter une défense contre les attaques de type "software supply chain") mais aussi la pratique, avec des workflows GitHub Actions et des policy Kyverno pouvant servir de base pour ses propres projets.

https://www.youtube.com/watch?v=cWpC96J05gI&list=PLmZ3gFl2Aqt8KydeXjUFbzjkTn4RtHcX1&index=6

secure supply chains alone secure software do not make
#sbom #slsa #securesupplychain

Overview for #opensource #software #developers - Supply Chain Security - #opensource #slsa #pyrsia #cyberdefense https://youtu.be/eRitoLswHgw