Lesson 5 of 10 · 6 min read
SLSA and Build Provenance
Build provenance is a signed, machine-readable statement of how an artifact was produced: which source revision, which build platform and process, and with which inputs. SLSA (Supply-chain Levels for Software Artifacts) defines levels of assurance for that provenance, from simply existing to being generated by a hardened, isolated build platform that the build itself cannot forge. Verifying provenance closes the gap code signing leaves: a validly signed artifact built from the wrong source.
free sign-in, no card required
Practise it as an interviewer asks it
How does code signing work, what does it guarantee, and what happens when a signing key is stolen?Why are pickle-based model files dangerous, and what does safetensors fix and not fix?Secure the model supply chain from download to deployment.How does Sigstore's keyless signing work, and what does the transparency log add?Design a detection-as-code programme: how are detections written, tested, reviewed, deployed and retired?What security risks does the Model Context Protocol (MCP) introduce?