cubefs
[Enhancement]: Add a framework of SLSA with a focus on mitigating supply-chain risk
Contact Details
No response
Is there an existing issue for this?
- [X] I have searched all the existing issues
What would you like to be added?
SLSA is aframework for assessing the security practices of a given software project with a focus on mitigating supply-chain risk. SLSA emphasises tamper resistance of artifacts as well asephemerality of the build and release cycle. SLSA mitigates a series of attack vectors in the soft ware development life cycle (SDLC), all ofwhich have seen real-world examples of successful attacks against open-source and proprietary software.
Why is this needed?
No response
Anything else?
No response
The compilation environment of SLSA on GitHub is relatively independent, while some binaries of CubeFS require more additional C-like libraries, so they need to be compiled in the customized Docker image of CubeFS. The method of running a custom Docker image in the GitHub SLSA action environment is currently under research. For more information on the progress of each module: #2811. PR to master see(#2813), to release 3.3.1 see(#2857)
