Supply-chain security is a procurement gate, not a nice-to-have. The EU Cyber Resilience Act makes SBOMs and signed binaries mandatory for anything sold into the EU. But SLSA L3, the level that actually convinces an auditor, sounds expensive. It does not have to be.
What SLSA L3 actually requires
SLSA L3 means the build is reproducible, the environment is hermetic, and the provenance is generated by the build platform itself. The key property: an external verifier can rebuild the artifact from source and get the same hash.
The cheap path
sapctl uses GitHub Actions as the build platform. The release workflow:
- builds with
-trimpathand a pinned Go toolchain, - generates a CycloneDX 1.7 SBOM with syft,
- signs the checksums with cosign keyless (Fulcio/OIDC),
- emits SLSA L3 provenance via the official builder.
Because GitHub Actions is the trusted build platform, the provenance is credible without a dedicated build farm. The cost is a YAML file, not a data center.
Verification
cosign verify-blob \
--certificate-identity-regexp='https://github.com/dixitsheta/sapctl/.github/workflows/release.yml@.*' \
--certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
--certificate=sapctl_1.0.0_checksums.txt.pem \
--signature=sapctl_1.0.0_checksums.txt.sig \
sapctl_1.0.0_checksums.txtThat one command proves the artifact came from the sapctl release pipeline and was not tampered with in transit.
What this buys you
SLSA L3 is within reach of a small team if you let the build platform do the work. The provenance is only as credible as the platform that issued it, and GitHub Actions, with its OIDC identity, is a platform auditors already trust.