Software supply chain security: signing, provenance and SLSA
You examine every link from source to deployment as a threat, sign images with cosign, produce provenance and build a chain that accepts only verified artefacts.
Level 401 · 17 lessons · 15 practice labs
Lessons
The threat map
- Supply chain attacks: source, build, package, deploy
- Lessons from real incidents: compromised build servers and packages
- Look-alike packages and dependency confusion
- Short task: draw a project’s supply chain and mark the weak links
Signing
- Signing with a key using cosign
- Keyless signing and the transparency log
- Verifying the signature on pull
- Package signatures: npm provenance and PyPI trusted publishing
- Short task: sign an image, tamper with it and watch verification fail
Provenance and SLSA
- SLSA levels: what they guarantee
- Provenance and attestations
- Verifying the chain of steps with in-toto
- Reproducible builds
- Short task: add a provenance attestation to the build pipeline
Admission policy
- A private package mirror and allowed sources
- Deploying only signed artefacts with known provenance
- Capstone: move an app onto an end-to-end verifiable chain
Practice labs
- Place supply chain attacks on their stages: Sort eight sample incidents into source, build, package and deploy stages.
- Draw a project’s supply chain and mark the weak links: Show every step from code to production, the external source used and the three points with no verification.
- Audit the risk of look-alike packages and dependency confusion: Check on the lab mirror whether the project’s internal package names could be claimed publicly, pin the source priority and list names prone to typos.
- Sign an image with a key using cosign: Generate a key pair, sign the image in the local registry and verify the signature.
- Change a signed image and watch verification fail: Rebuild the image and push it to the same tag, then explain with digests why verification fails.
- Verify keyless signing and the transparency log: Sign with an identity through the lab signing service, find the entry in the transparency log and write a verification that accepts only the expected identity.
- Match SLSA levels to their guarantees: Place six guarantee statements under the right SLSA level.
- Add a provenance attestation to the build pipeline: Make the pipeline produce and sign an attestation recording source commit and builder alongside the image, and verify it.
- Verify the chain of steps with in-toto and test a reproducible build: Define the steps and authorised keys in a layout, show a skipped step is caught at verification and compare the digests of two builds.
- Read the package sources from the configuration: State which registries pip and npm use and in what order from their configuration.
- Set up a private package mirror and restrict allowed sources: Configure the build to pull packages only from the lab mirror and show a package missing from the mirror cannot be installed.
- Verify package provenance before install: Write an install step that checks the provenance attestation from the release pipeline and the hashes, and show a manually uploaded package is refused.
- Run the signature verification command before deploying: Verify one signed and one unsigned image and compare the results.
- Write the step that deploys signed artefacts only: Add signature and provenance checks to the deploy script and stop the deployment on failure.
- Move an app onto an end-to-end verifiable chain: Build the chain with pinned sources, a signed image, a provenance attestation and verification at deploy, and show a planted fake artefact is refused.
About this course
You examine every link from source to deployment as a threat, sign images with cosign, produce provenance and build a chain that accepts only verified artefacts.
What you will learn
- The threat map
- Signing
- Provenance and SLSA
- Admission policy
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.