19/06/2021
Google Releases New Framework to Prevent Software Supply Chain Attacks ::--
As software supply chain attacks emerge as a point of concern in the wake of SolarWinds and Codecov security incidents, Google is proposing a solution to ensure the integrity of software packages and prevent unauthorized modifications.
Called "Supply chain Levels for Software Artifacts" (SLSA, and pronounced "salsa"), the end-to-end framework aims to secure the software development and deployment pipeline — i.e., the source ➞ build ➞ publish workflow — and mitigate threats that arise out of tampering with the source code, the build platform, and the artifact repository at every link in the chain.

Google said SLSA is inspired by the company's own internal enforcement mechanism called Binary Authorization for Borg, a set of auditing tools that verifies code provenance and implements code identity to ascertain that the deployed production software is properly reviewed and authorized.
"In its current state, SLSA is a set of incrementally adoptable security guidelines being established by industry consensus," said Kim Lewandowski of Google Open Source Security Team and Mark Lodato of the Binary Authorization for Borg Team....
