Kosli white paper library

How to secure your software supply chain with Artifact Binary Provenance

In Kosli, we use Artifact Binary Provenance as the foundation for our audit trails. Artifact Binary Provenance is a fancy term, but the idea behind it is really quite simple. All it means is that we can identify the software we have running in production. Let’s take a closer look

Authors

Mike Long

• Continuous Compliance

Supply Chain Levels for Software Artifacts (SLSA)

Supply chain Levels for Software Artifacts (SLSA) is a security framework that assists in ensuring the integrity of software artifacts throughout the software supply chain. The Open Source Security Foundation (OpenSSF) introduced SLSA in 2021 to protect software from sources through deployment by helping organizations to counter critical threats. SLSA provides a model for improving supply chain security and integrity, and offers guidance for solving issues related to developer or build systems as exploitable security vectors.

Authors

John Willis
Distinguished Researcher @Kosli

Bill Bensing
Field CTO @Kosli