TODO: Need mitigation description for "Software producer intentionally submits bad code" threat

[lehors]

No description provided.

[zachariahcox]

I think the changes needed are here:
https://github.com/search?q=repo%3Aslsa-framework%2Fslsa%20Software%20producer%20intentionally&type=code

EDIT: nope!
it's in the draft folder: https://github.com/search?q=repo%3Aslsa-framework%2Fslsa+Software+producer+intentionally+path%3A%2F%5Edocs%5C%2Fspec%5C%2Fdraft%5C%2F%2F&type=code

https://github.com/slsa-framework/slsa/tree/main/docs/spec/draft

[michaelwinser]

Mitigating against this threat and more generally across major organizational trust boundaries is not a well solved problem.

Question: is this a case of the "software producer intentionally submits bad code" or "someone inside the software producer organization intentionally submits bad code."

The most formal approach is to trest all externally produced software as source code that is being imported into your internal source tree.

1. All changes should be reviewed by two internal parties
2. Always build from source

In practice this is not always possible. Organizations can and do rely on 3rd party auditors. Organizations can and should also ask for evidence of secure practices.

At the end of the day, if an organization cannot be trusted but its software is essential then sandboxing and runtime auditing woudl be required.