Скачать или смотреть Dirty Dancing - Untrustworthy SLSA Build Provenance - John Kjell, ControlPlane

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon events in Amsterdam, The Netherlands (23-26 March, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

Dirty Dancing - Untrustworthy SLSA Build Provenance - John Kjell, ControlPlane

Achieving SLSA Build Level 3 is often seen as the gold standard for building trusted software. Projects across CNCF and the broader open source community proudly declare they've reached this milestone but, what does that actually prove?

This talk breaks down what SLSA Level 3 really means, using the official slsa-github-generator workflow as a case study. We’ll examine how provenance is generated, what’s verified (and what isn’t), then walk through examples where provenance can appear valid but should not be trusted.

We’ll explore how subtle gaps in build tooling, configuration, or verification can undermine trust, and offer practical guidance on:
Comparing other builders to the official SLSA tooling
Identifying red flags in provenance attestations
Using SLSA tools correctly to ensure real trust

It’s a reality check for consumers and maintainers alike, helping them understand not all provenance is created equal.