6. Adopt SLSA Level 3 and OSV/Grype for supply-chain security
Date: 2026-07-13
Status
Accepted
Context
UAR consumes a large dependency graph and ships a container image. Operators and enterprise consumers need evidence of provenance, SBOMs, and vulnerability posture. The operator requested SLSA Level 3 self-attestation as the target.
Decision
- Use
slsa-github-generatorin a reusable.github/workflows/provenance.yml. - Sign provenance in an isolated job separate from the build job.
- Attest SBOMs with
actions/attest-sbom. - Run nightly vulnerability scans with
osv-scannerandgrype; block onHIGHandCRITICALfindings for published artifacts. - Publish
/.well-known/security.txtwith a PGP key and a 90-day disclosure SLA. - Add a best-effort reproducible-builds verification job.
Consequences
- Consumers can verify the runtime artifact with
slsa-verifierandcosign. - Vulnerability findings are surfaced within 24 hours of database updates.
- Release artifacts include signed provenance and SBOM attestations.
Alternatives considered
- Outsource to a third-party attestation service: rejected because it introduces vendor lock-in and ongoing cost.
- SLSA Level 2: rejected because the operator explicitly wanted Level 3.