SLSA Compliance and Attestation

1 post · Feb 2022 – Nov 2022

What this trail covers

GitLab enhances its DevSecOps platform to support Supply chain Levels for Software Artifacts (SLSA) compliance. The platform currently supports SLSA Levels 1 and 2 by enabling the generation of artifact metadata directly within the GitLab Runner. This post details the introduction of automated compliance attestation in Release 15.1, where GitLab Runner can generate and produce attestation metadata for all build artifacts by setting the RUNNER_GENERATE_ARTIFACTS_METADATA environment variable. This capability tracks the ongoing efforts to ensure secure software supply chains.

All GitLab trails

Nov 2022Achieve SLSA Level 2 compliance with GitLabThis post introduces the capability for GitLab to generate SLSA-compliant artifact metadata. By setting `RUNNER_GENERATE_ARTIFACTS_METADATA: true` in `.gitlab-ci.yml`, users can generate a `data.txt` file and an accompanying `.json` metadata file within the GitLab Runner. This metadata includes details about the build process, input parameters, and repository SHA hashes, providing provenance and tamper-detection capabilities for artifacts.
Aug 2022Securing the software supply chain through automated attestationThis post details the introduction of automated compliance attestation in GitLab Release 15.1. It explains that GitLab Runner can generate and produce attestation metadata for all build artifacts by setting the RUNNER_GENERATE_ARTIFACTS_METADATA environment variable to 'true'. The metadata is rendered in a plain text .json file stored with the artifact. It also discusses the demand for attestation automation, the importance of building it into the development lifecycle, and future plans for integrated code signing and broader participation.
Mar 2022Comply with NIST's secure software supply chain framework with GitLabThis post explains how GitLab's platform addresses the NIST SSDF 1.1 framework by mapping its features to the four key practices: prepare the organization, protect software, produce well-secured software, and respond to vulnerabilities. It highlights specific GitLab features like policy management, role-based permissions, security dashboards, source code management, commit signatures, code reviews, hardened containers, SBOM, security scanning, credential management, vulnerability reports, and Auto DevOps for compliance enforcement and vulnerability response.
Mar 2022How to enhance supply chain security with GitLab and TestifySecThis post announces the integration of TestifySec's Witness tool into GitLab, enabling the verifiable and standardized recording of CI process data, including AWS identity metadata, linked to build artifacts. This contributes to GitLab's Secure Software Supply Chain Direction and SLSA compliance by providing a chain of custody from code creation through deployment.
Feb 2022Introducing GitLab’s supply chain security direction and landscapeThis post introduces GitLab's direction and framework for Software Supply Chain Security (SSCS), outlining five key aspects: Source, Build, Consumption, Management Process, and Tool Security. It emphasizes the benefits of a single application for SSCS, such as minimizing tools, reducing failure points, enabling seamless interoperability, and simplifying visibility. It also highlights existing GitLab capabilities that support continuous compliance and secure supply chains, and mentions near-term projects like enhancements to GitLab Runner Core.
Advertisement