Skip to main content

Google Releases New Framework to Prevent Software Supply Chain Attacks.

By Editor


Software Supply Chain Attacks

As software supply chain attacks emerge as a point of concern in the wake of SolarWinds  and Codecov  security incidents, Google is proposing a solution to ensure the integrity of software packages and prevent unauthorized modifications.

Called "Supply chain Levels for Software Artifacts" (SLSA, and pronounced "salsa"), the end-to-end framework aims to secure the software development and deployment pipeline — i.e., the source ➞ build ➞ publish workflow — and mitigate threats that arise out of tampering with the source code, the build platform, and the artifact repository at every link in the chain.

"In its current state, SLSA is a set of incrementally adoptable security guidelines being established by industry consensus," said Kim Lewandowski of Google Open Source Security Team and Mark Lodato of the Binary Authorization for Borg Team.Google said SLSA is inspired by the company's own internal enforcement mechanism called Binary Authorization for Borg, a set of auditing tools that verifies code provenance and implements code identity to ascertain that the deployed production software is properly reviewed and authorized.

code dependencies

"In its final form, SLSA will differ from a list of best practices in its enforceability: it will support the automatic creation of auditable metadata that can be fed into policy engines to give 'SLSA certification' to a particular package or build platform."

The SLSA framework promises end-to-end software supply chain integrity and is designed to be both incremental and actionable. It comprises four different levels of progressive software security sophistication, with SLSA 4 offering a high degree of confidence that the software has not been improperly tinkered.

  • SLSA 1 — Requires that the build process be fully scripted/automated and generate provenance
  • SLSA 2 — Requires using version control and a hosted build service that generates authenticated provenance
  • SLSA 3 — Requires that the source and build platforms meet specific standards to guarantee the auditability of the source and the integrity of the provenance
  • SLSA 4 — Requires a two-person review of all changes and a hermetic, reproducible build process

"Higher SLSA levels require stronger security controls for the build platform, making it more difficult to compromise and gain persistence," Lewandowski and Lodato noted.

While SLA 4 represents the ideal end state, the lower levels provide incremental integrity guarantees, at the same time making it difficult for malicious actors to stay concealed in a breached developer environment for extended periods of time.

"Achieving the highest level of SLSA for most projects may be difficult, but incremental improvements recognized by lower SLSA levels will already go a long way toward improving the security of the open source ecosystem," the company said.Along with the announcement, Google has shared additional details about the source and Build  requirements that need to be satisfied, and is also calling on the industry to standardize the system and define a threat model that details specific threats SLSA hopes to address in the long term.



#THN


#osutayusuf

Comments

Post a Comment

Popular posts from this blog

UGANDA ELECTORAL COMMISSION TO ELIMINATE NATIONAL IDENTIFICATION CARDS (IDs) FOR 2021 GENERAL ELECTIONS.

By Editor
The elimination of using National IDs (Ndagamuntu) for the 2021 elections should not have come as a surprise. One would be very NAIVE to think that Bobi Wine has not prepared for this in his Business Plan under the RISK section. It is public knowledge that our EC is not independent.  It is also public knowledge that Military Dictator Yoweri Museveni will never lose an election. What stunned us this morning is when we noticed that on social media, people were mocking Bobi with his "get your Ndagamuntu".  We are on record for saying to all Our readers that the National ID is like Apartheid in South Africa. Students of History would know how those IDs were being used to arrest people, deny them jobs, deny them basic services. Consequently, Bobi was not wrong and will never be wrong on the Ndagamuntu. Except the ones attacking him and mocking him forget that in Uganda, now, no National ID (Ndagamuntu), no service.  If you have not been denied registering your child i...
Post a Comment
Read more

Parliament Urges Government to Provide Shs 4 Billion to Media Houses to Run Awareness Campaign on Tourism in Uganda.

By Editor
Parliament also urged Gov’t to provide additional Shs4Bn to UTB to engage international and national media houses in production of positive media stories for improved destination image, following reports of drop in number of tourists from US, Europe and China visiting Uganda. "The National Development Plan targeted to cumulatively attract 281,760 International Tourist arrivals from US, Europe & China but only 67,252 arrivals were registered by the end of the first half of FY 2023/24. The U.S, Europe & China were key target source for leisure tourist who stay longer than business tourists. However, statistics show that international arrivals from the aforementioned areas have continue to drop. The UTB requires Shs4Bn to engage international & national media houses in production of positive tourism stories to improve destination perception in light of recent controversies that shade the destination in a bad light. However, this has remained unfunded,” said La...
Post a Comment
Read more

UPDF has Rehabilitated Boreholes and Shallow Wells in Maracha District Ahead of 45th Tarehe Sita.

By Editor
Story by Osuta Yusuf. Maracha District.  30-12-2025. 📸: The technical team fixing some of the  boreholes. Photo by Osuta Yusuf, Our News Reporter. The Uganda Peoples Defence Forces (UPDF) which is the legally constituted security organ to guard and protect the people, properties and sovereignty of Uganda, have rehabilitated a total of 9 Boreholes and shallow wells at the tune of 15m Shs in 7 Sub-counties out of the 19 Sub-counties in Maracha District through a service dubbed under the Theme of “QUICK IMPACT PROJECT” directly financed by the UPDF, ahead of preparation for the celebration of their next year's 2026 Tarehe Sita anniversary. 📸: Official launch of UPDF’s 45th Tarehe Sita celebration ahead of the due date 6-February-2026. Courtesy Photo. The UPDF Tarehe Sita is an annual public holiday and event that takes place on every 6th of February, the date when the then Uganda Patriotic Movement (UPM) party now turned as National Resistance Army / Movement (NRA / M) headed b...
Post a Comment
Read more