SLSA adoption study (Tamanna et al., 2024)

SLSA adoption study

The arXiv record for 2409.05014 names six authors: Mahzabin Tamanna, Sivana Hamer, Mindy Tran, Sascha Fahl, Yasemin Acar and Laurie Williams. Its abstract says that the study analyzed 1,523 SLSA-related issues extracted from 233 GitHub repositories. It used a topic-guided thematic analysis with Latent Dirichlet Allocation (LDA), and identified four challenges and five suggested adoption strategies.

The current version is titled “Analyzing Challenges in Deployment of the SLSA Framework for Software Supply Chain Security”. Version 1, submitted on 8 September 2024, was titled “Unraveling Challenges with Supply-Chain Levels for Software Artifacts (SLSA) for Securing the Software Supply Chain”.

docs/about.md cites the study as Tamanna et al. (2024), Analyzing Challenges in Deployment of the SLSA Framework for Software Supply Chain Security, the arXiv record’s current title. It says that the slsa_adoption module encodes the four challenge themes and five strategy themes as enums on SlsaAdoptionMetadata. The slots hermetic, provenance_generation_tool, attestation_storage_uri and review_type record the practices the study discusses, and a comment on the element concerned cites the study’s theme.

In the schema, SlsaAdoptionChallenge holds COMPLEX_IMPLEMENTATION, UNCLEAR_COMMUNICATION, LIMITED_FEASIBILITY and UNCLEAR_RELEVANCE. SlsaAdoptionStrategy holds ENHANCE_ALIGNMENT_FLEXIBILITY, PROVIDE_DETAILED_DOCUMENTATION, STREAMLINE_PROVENANCE_GENERATION, IMPROVE_VERIFICATION_PROCESS and COLLABORATE_WITH_COMMUNITY.

Comments in slsa_adoption.yaml give each challenge theme’s sub-themes and issue count:

• complex implementation: complicated provenance generation and intricate tool maintenance, 901 issues;
• unclear communication: unclear definitions of key terms and unclear documentation, 357 issues;
• limited feasibility: limited attestation verification and two-party review requirements, 219 issues;
• unclear relevance: one sub-theme of the same name, 46 issues.