The State of Git Security With SLSA and Gittuf

Explore the current landscape of Git security through this 24-minute conference talk that examines how security policies can be implemented independently of forge platforms. Learn about gittuf, a system that enables repository security policy declaration and verification without relying on external platforms, and discover how Git security extends beyond simple write access controls. Understand the challenges of implementing read permissions while maintaining Git's version control capabilities and explore standardization efforts for Git security projects. Gain insights into OpenSSF projects including gittuf and the SLSA Source Track, with detailed coverage of recent developments such as read permissions for Git repositories, standardization initiatives based on gittuf concepts, and SLSA source provenance generation. Discover how these tools and frameworks work together to enhance the security posture of Git repositories while maintaining the flexibility and distributed nature of Git version control.