Security best practices

We discussed security-related topics in the previous chapter. In this section, we will add some more best practices that we have found useful when it comes to securing delivery processes.

Supply-c Levels for Software Artifacts (SLSA)

SLSA (pronounced salsa) is a security framework of best practices for ensuring the integrity of software artifacts throughout the entire software supply chain. It consists of incrementally adopted security guidelines for the software supply chain, offering a four-level hierarchy of maturity, where the fourth level is the desired end state:

1. SLSA 1: Indicates adoption of fully scripted/automated build processes and generate provenance statements. They display evidence of how the artifact was built, including the build process and the dependencies.
2. SLSA 2: Indicates adoption of version-controlled deliveries and a hosted build service that generates provenance.
3. SLSA 3: Indicates adoption of source and that the...