SLSA Deep Dive: Securing the Supply Chain Using Verifiable Levels

Introduction When I first investigated the SolarWinds incident, one technical detail absolutely floored me. The attackers planted malware called SUNSPOT on SolarWinds' build servers. SUNSPOT monitored the build process every single second, and the moment the Orion platform build kicked off, it swapped the InventoryManager.cs source code with a backdoored version. Once the build finished, it swapped it back. Zero traces were left in the source code repository. The resulting binary was signed with