The State of Git Security With SLSA and Gittuf

Explore the current landscape of Git security through this 24-minute conference talk that examines how traditional forge platform security measures are evolving beyond basic write access controls. Learn about gittuf, a system that enables repository-specific security policy declarations independent of forge platforms, and discover how it provides independently verifiable security measures for anyone with repository access. Delve into advanced Git security concepts including read permissions for sensitive repository data while maintaining version control functionality, and understand the standardization efforts aimed at making gittuf adoptable across all Git security projects. Examine the intersection of Git security with OpenSSF projects, particularly the SLSA Source Track, and gain insights into SLSA source provenance generation. Discover the latest developments in gittuf including read permission implementations, standardization initiatives, and the broader implications for source code security and provenance in modern software development workflows.