Enhance Software Security with SLSA and Sonatype | Blog

What Goes Great With SLSA? Sonatype.

December 06, 2023
By Jeff Wayman

7 minute read time

In our previous blog post, we delved into the critical role of SLSA in bolstering software supply chain security. Shifting the focus, this post centers on the seamless compatibility between SLSA and Sonatype products, highlighting the powerful synergy that can enhance your software security efforts.

Drawing parallels with food safety guidelines, where the FDA safeguards both producers and consumers, SLSA serves as a comparable framework for the software industry. Similar to ensuring the safety and authenticity of ingredients in the culinary world, SLSA ensures the credibility and integrity of software components in the tech realm.

In essence, SLSA acts as a common language, guiding leaders and teams to elevate software security levels in managing the software supply chain. While acknowledging existing gaps, it plays a crucial role in fortifying software security and managing supply chains.

For those well-versed in the benefits of SLSA, this post will directly explore how Sonatype and our products seamlessly support and extend the goals of SLSA, forming a robust alliance in your software security initiatives.

SLSA + Sonatype: Tackling Specific Supply Chain Threats

SLSA can be an invaluable tool for helping secure your software supply chain, offering a standardized approach to evaluate and enhance trustworthiness throughout the development and distribution process. Best of all, it works on both sides, providing benefits for producers and consumers by establishing a universal framework for supply chain security.

However, without the support of tooling, much of what SLSA recommends will need to be done manually and likely won't scale for large enterprises. The Sonatype Platform directly addresses a number of the threats identified by SLSA, and in a number of cases, it extends or even provides support for critical threats where SLSA doesn't currently apply.

In the following section, we've outlined specific threat use cases provided by SLSA, along with both the SLSA recommendations and the ways the Sonatype Platform can help.

SLSA Use Case: Build From Modified Source (Not Matching Source Repository)

In the case of Webmin, the attacker manipulated the build infrastructure to incorporate source files that did not align with the designated source control.

SLSA recommendation: A SLSA-compliant build server would have generated provenance records, disclosing the actual sources utilized. This would have enabled consumers to swiftly identify such unauthorized modifications.

How Sonatype helps:

SLSA Use Case: Use Compromised Dependency (i.e. A-H, Recursively)

A compromised dependency like event-stream was manipulated by an attacker, who added an innocuous version initially and later updated it with malicious behavior, avoiding detection on GitHub.

SLSA recommendation: Applying SLSA recursively to all dependencies would have prevented this attack, as it would have revealed the improper source or builder, indicating a potential security threat.

How Sonatype helps:

SLSA Use Case: Compromise Package Registry

In scenarios involving attacks on Package Mirrors, a researcher operated mirrors for widely used package registries, potentially serving malicious packages.

SLSA recommendation: Provenance records of the compromised artifacts would have revealed they were not built as anticipated or sourced from the expected repository, thus flagging them as potential threats.

How Sonatype helps:

SLSA Use Case: Use Compromised Package

In the case of Browserify typosquatting, the attacker uploaded a malicious package with a name similar to the original.

SLSA recommendation: While SLSA does not directly address this specific type of threat, it underscores the importance of provenance linking back to source control, which can serve as a foundational element for enhancing other security solutions.

How Sonatype helps:

SLSA Use Case: Dependency Becomes Unavailable

A package or its version may be intentionally removed from the repository by the producer without any prior notice, which became the case with Mimemagic. Alternatively, network errors or service outages could temporarily render packages inaccessible.

SLSA recommendation: While SLSA does not directly tackle this threat, it does facilitate and enhance other solutions through provenance linking back to source control.

How Sonatype helps: Employing an artifact repository manager like Nexus Repository guarantees that developers have access to components required by their builds regardless of any change in external availability (e.g. public repository). This stands in contrast to results from public sources, even an official repository, which could be more susceptible to availability changes.

Written by Jeff Wayman

Currently in his second tour at Sonatype, Jeff is our resident Conduit of Goodness, helping bridge gaps across teams to improve developer relations, content strategy, and brand awareness. In the past, he served and led teams across product management, technical writing, and customer education. When not writing about cybersecurity and open source software, you can find him outside (likely in the humid southeast) enjoying time with his family.