Your organization develops software involved in many open source projects and is concerned about software supply chain threats. You need to deliver provenance for the build to demonstrate the…

Question

Options

• A
  1. Hire an external auditor to review and provide provenance.
• B
  1. Review the software process.
• C
  1. Publish the software code on GitHub as open source.
• D
  1. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud

• A
  6% (3)
• B
  12% (6)
• C
  4% (2)
• D
  79% (41)

Explanation

SLSA (Supply Chain Levels for Software Artifacts) is a security framework specifically designed to address software supply chain integrity. Level 3 provides strong guarantees by requiring a hardened, auditable build platform where provenance is automatically generated and signed. Google Cloud Build can generate SLSA-compliant provenance attestations, cryptographically proving what code was built, how it was built, and by whom - directly demonstrating the software is untampered. The other options do not provide cryptographic provenance: hiring an auditor (A) is a manual process with no technical guarantees, reviewing the process (B) produces no artifact, and publishing on GitHub (C) improves transparency but does not prove build integrity.

No community discussion yet for this question.