content: draft: Add mitigation for malicious source platform admin. #1188
Conversation
Using the same language we have for "Compromise build platform admin". Filed slsa-framework#1187 to track Fixes slsa-framework#1179. Signed-off-by: Tom Hennen <[email protected]>
✅ Deploy Preview for slsa ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
TomHennen
changed the title
There was a problem hiding this comment.
We have a build platform operations track in the future directions: https://slsa.dev/spec/v1.0/future-directions
Should we make a reference to that?
…ions to examples Signed-off-by: Tom Hennen <[email protected]>
Signed-off-by: Tom Hennen <[email protected]>
Done. |
Signed-off-by: Tom Hennen <[email protected]>
There was a problem hiding this comment.
great start.
any package registry admin prior art would be pretty applicable here.
We could also talk about use of externally verifiable data for certain use cases (like signed refs) or signed source provenance docs.
like two-set-of-eyes rules, it makes attacks more expensive and difficult to accomplish.
FWIW the goal wasn't really to address this threat with SLSA, but just mention it as a thing folks should consider. That doesn't mean we can't address it in the future, just get rid of the TODO. So, how complete did we want this to be for 1.1? @lehors any thoughts |
As far as I'm concerned, I think what you're proposing is enough for 1.1. This can always be improved as we move forward. |
Fix link Signed-off-by: Arnaud J Le Hors <[email protected]>
Add mitigation for malicious source platform admin.
We didn't have any guidance for this threat. There are a number of ways we may be able to address this in the future via the SLSA Source Track and/or tools like gittuf. However, SLSA doesn't currently address them. This entire section is already labeled as not being handled by SLSA but does still include other mitigations.
I'm using the same language we have for "Compromise build platform admin", which seems like the same sort of threat, and should work 'fine' until we have something better.
Filed #1187 to track
Fixes #1179.