Uploaded April 2026 | Updated September 2026, 22 hours ago
Getting to SLSA Build Level 3 sounds great on paper, but in practice the hardest problems show up inside the build system itself—where isolation, trust boundaries, and automation collide with real-world CI/CD constraints. In this session, we’ll share firsthand experiences pushing builds toward SLSA 3, from discovering why “containerized” isn’t truly isolated, to redesigning build environments and separating signing and provenance from the build process. We’ll dig into build isolation, provenance generation, and the operational telemetry that reveals where theory breaks down in modern pipelines. Expect a candid look at what actually works (and what definitely doesn’t), along with practical guidance for using SLSA to clearly explain how your build system mitigates supply chain threats for your organization.
Learn more about SLSA 3 at Chainguard: https://www.chainguard.dev/unchained/this-shit-is-hard-slsa-l3-and-beyond
About Chainguard
Founded by the industry's leading experts on open source software, security and cloud native development, we are on a mission to be the safe source for open source.
Where to find us:
Website: https://www.chainguard.dev/
Twitter: twitter.com/chainguard_dev
LinkedIn: linkedin.com/company/chainguard-dev
TikTok: tiktok.com/@chainguard_dev
Getting to SLSA Build Level 3 sounds great on paper, but in practice the hardest problems show up inside the build system itself—where isolation, trust boundaries, and automation collide with real-world CI/CD constraints. In this session, we’ll share firsthand experiences pushing builds toward SLSA 3, from discovering why “containerized” isn’t truly isolated, to redesigning build environments and separating signing and provenance from the build process. We’ll dig into build isolation, provenance generation, and the operational telemetry that reveals where theory breaks down in modern pipelines. Expect a candid look at what actually works (and what definitely doesn’t), along with practical guidance for using SLSA to clearly explain how your build system mitigates supply chain threats for your organization.
Learn more about SLSA 3 at Chainguard: https://www.chainguard.dev/unchained/this-shit-is-hard-slsa-l3-and-beyond
About Chainguard
Founded by the industry's leading experts on open source software, security and cloud native development, we are on a mission to be the safe source for open source.
Where to find us:
Website: https://www.chainguard.dev/
Twitter: twitter.com/chainguard_dev
LinkedIn: linkedin.com/company/chainguard-dev
TikTok: tiktok.com/@chainguard_dev
