content: draft: Add mitigation for compromised build tooling #1251
Conversation
This threat can be mitigated in a number of ways, here I address it in the simplest one, verifying the tooling prior to use. You can also imagine resolving it by recording the digests in the provenance, and propagating VSAs so that downstream verifiers can verify recursively, but that's pretty complicated. You can also resolve this with the attested build environments track, but I don't think we should mention that here until it's finalized? Or maybe we can point to it now as 'coming soon'? fixes slsa-framework#1184 Signed-off-by: Tom Hennen <[email protected]>
✅ Deploy Preview for slsa ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
As a status update, I am still hoping to open a PR before EOY where we describe the detailed verification requirements for the BuildEnv track. That said, these requirements are already laid out at a high level in |
Looking at the current 1.1RC terminology page, the terminology page with the build environment model isn't included. So, I think the most we should do at this point is say that the "upcoming build environment track may provide additional assurances against this threat" |
Signed-off-by: Tom Hennen <[email protected]>
Signed-off-by: Tom Hennen <[email protected]>
Signed-off-by: Tom Hennen <[email protected]>
There was a problem hiding this comment.
Thanks for the updates @TomHennen ! I'm happy to approve this once my comment has been resolved.
Signed-off-by: Tom Hennen <[email protected]>
Co-authored-by: Marcela Melara <[email protected]> Signed-off-by: Tom Hennen <[email protected]>
Co-authored-by: Trishank Karthik Kuppusamy <[email protected]> Signed-off-by: Tom Hennen <[email protected]>
Signed-off-by: Tom Hennen <[email protected]>
This threat can be mitigated in a number of ways, here I address it in the simplest one, verifying the tooling prior to use. You can also imagine resolving it by recording the digests in the provenance, and propagating VSAs so that downstream verifiers can verify recursively, but that's pretty complicated.
You can also resolve this with the attested build environments track, but I don't think we should mention that here until it's finalized? Or maybe we can point to it now as 'coming soon'?
fixes #1184