Lion Cipher Lab

Verify build provenance with SLSA (prove HOW and by WHOM an artifact was built)

• Cloud Security
• Intermediate
• ~45-60 min
• Free · no account required

Why it matters

You almost never build the software you run. You download a release binary from a project's downloads page, pull a container image someone else published, install a CLI tool with one command. Each of those is an ARTIFACT -- a single finished, downloadable thing -- and between the person who built it and you it passed through a SUPPLY CHAIN of build servers, package registries, and mirrors. Anywhere along that path an attacker can swap in a poisoned copy, and by default you cannot tell: a malicious binary looks identical from the outside. The Cosign lab answered half the question -- 'is this…

What you'll learn

• what 'build provenance' is in plain terms: a signed record of WHO built an artifact, from WHICH source commit, on WHAT builder
• the vocabulary from zero: supply chain, artifact, attestation, provenance, in-toto, predicate, subject, builder, SLSA level, SLSA track
• what SLSA (Supply-chain Levels for Software Artifacts, an OpenSSF framework) is, and what its Build levels L0-L3 actually promise
• installing verifiers on Windows/macOS/Linux: the GitHub CLI (gh) and/or slsa-verifier, from their official sources
• downloading a REAL public artifact that ships provenance and locating its attestation
• verifying a PASS with 'gh attestation verify' (pinning --owner/--repo) and/or 'slsa-verifier verify-artifact' (pinning --source-uri)
• forcing a FAIL two ways -- tamper one byte of the artifact, and pin the WRONG expected source -- and reading why each is rejected
• the judgment that separates real practitioners: verified provenance proves origin + integrity, NOT that the code is trustworthy or bug-free
• why verification is meaningless unless you PIN the expected source repo and builder in advance
• how provenance VERIFICATION complements Cosign SIGNING -- two distinct layers of the same defense

Steps in this lab

1. The question provenance answers: how and by whom was this really built?
2. The words you need first, from zero: attestation, in-toto, subject, predicate, builder
3. Install a verifier -- the GitHub CLI (gh) and/or slsa-verifier
4. Get a REAL artifact that ships provenance -- and find its attestation
5. Verify a PASS -- and PIN the source you expect (this is the whole game)
6. Make it FAIL -- two ways -- and watch verification protect you
7. Judgment: provenance proves ORIGIN, not TRUST -- and what SLSA levels really mean
8. Judgment: how this complements SIGNING (Cosign) -- and when it is overkill
9. What you just did -- and the habit to keep

Open the full interactive lab →