Quoting from the SLSA specification:
High profile attacks like those against SolarWinds or Codecov have exposed the kind of supply chain integrity weaknesses that may go unnoticed, yet quickly become very public, disruptive, and costly in today’s environment when exploited. They’ve also shown that there are inherent risks not just in code itself, but at multiple points in the complex process of getting that code into software systems—that is, in the software supply chain. Since these attacks are on the rise and show no sign of decreasing, a universal framework for hardening the software supply chain is needed, as affirmed by the U.S. Executive Order on Improving the Nation’s Cybersecurity.
And further:
SLSA is a set of incrementally adoptable guidelines for supply chain security, established by industry consensus. The specification set by SLSA is useful for both software producers and consumers: producers can follow SLSA’s guidelines to make their software supply chain more secure, and consumers can use SLSA to make decisions about whether to trust a software package.
GitHub has added support for non-forgeable build provenance when using GitHub Actions—two years ago. This achieves SLSA level 3 build provenance, which provides strong guarantees that the build has not been tampered with, contains the code it says it does, and generally makes it impractical to compromise the build process. This is a huge step forward!
Considering this, I wanted to know what Atlassian is doing in terms of making Bitbucket Pipelines conform to SLSA. Is anyone working on this yet, and if so, is a release planned yet? I could not find anything online. To the contrary, as the Docker BuildX plugin is disabled and the Docker client version is locked to a version released in April 2023 that doesn't yet have the ability generate attestation data, we cannot even attach attestation to Docker images built within Pipelines.
This makes it pretty much impossible to generate any provenance about build artefacts in Pipelines.
Looking forward to your reply.
