Hands-on from the first module

14 labs and a capstone, all in one sandbox repository you own. You watch one real pipeline improve step by step, and every lab produces something you keep.

Built to refuse, not just record

Most teams stop at generating provenance. This course gets you to a check that actually turns untrusted software away, with a rollout plan that won't break production.

Honest about the limits

You learn which attacks SLSA stops and which it doesn't, including xz-utils, so you can explain your program to engineers and executives without overclaiming.

About the course

SLSA (pronounced "salsa") is the OpenSSF framework for build and source integrity. In this course you take one real GitHub Actions pipeline from no provenance at all to a deployment gate that turns untrusted software away, covering both the Build and Source tracks of SLSA v1.2. It's for software engineers, platform engineers and DevSecOps teams who own a build pipeline. You should be comfortable with git, CI pipelines, JSON and a terminal; no cryptography background is needed. You'll need a free GitHub account and a Mac, Linux or Windows 11 computer.

Jil Wright Instructor

Jil Wright

Jil Wright is the president of Wrightbrained Security. She works as a vCISO and a Lead CMMC Certified Assessor, and holds the CISM, CCA and LCCA certifications. Her day job is checking whether security controls actually do what organizations say they do, which is exactly what this course teaches you to do for your software.

Curriculum

7 Chapters · 31 Lessons

    1. Welcome Free preview
    2. Start Here Free preview
    3. (Included in full purchase)

      Your course downloads

    4. (Included in full purchase)

      Visual guide: Securing the Software Supply Chain

    5. The Fast Path Free preview

    1. (Included in full purchase)

      Tooling Appendix

    2. (Included in full purchase)

      Lab checker

    1. (Included in full purchase)

      Module 0: Orientation & Lab Setup

    2. (Included in full purchase)

      Module 1: The Supply Chain Threat Model

    3. (Included in full purchase)

      Module 2: Tracks, Levels & What v1.2 Changed

    4. (Included in full purchase)

      Part I review

    1. (Included in full purchase)

      Module 3: Provenance & the Attestation Stack

    2. (Included in full purchase)

      Module 4: Build L1: Generating & Distributing

    3. (Included in full purchase)

      Module 5: Build L2: Signing & Hosted Builds

    4. (Included in full purchase)

      Module 6: Build L3: Unforgeability & Isolation

    5. (Included in full purchase)

      Visual guide: The Rules of Evidence

    6. (Included in full purchase)

      Part II review

    1. (Included in full purchase)

      Module 7: Source L1 to L2: Version Control & Provenance

    2. (Included in full purchase)

      Module 8: Source L3: Continuous Technical Controls

    3. (Included in full purchase)

      Module 9: Source L4: Two-Party Review

    4. (Included in full purchase)

      Part III review

    1. (Included in full purchase)

      Module 10: Verification: From Attestation to Decision

    2. (Included in full purchase)

      Module 11: VSAs & Delegated Trust

    3. (Included in full purchase)

      Module 12: Enforcement in the Deployment Path

    4. (Included in full purchase)

      Visual guide: The Unbroken Chain

    5. (Included in full purchase)

      Part IV review

    1. (Included in full purchase)

      Module 13: What SLSA Doesn't Do

    2. (Included in full purchase)

      Module 14: Adoption Roadmap & Capstone

    3. (Included in full purchase)

      Part V review

    4. (Included in full purchase)

      Submit your capstone

    5. (Included in full purchase)

      You're done

Common questions

I'm on Windows. Can I take it?

Yes. Most students are on Windows 11. You work in Ubuntu through WSL, and Module 0 walks you through the setup step by step. Every lab has notes for anything that's different on Windows.

Does it count for CPE credit?

You get a certificate for 10 hours of training that you can submit for CPE credit. We can't promise that any certification body will accept it. Each one, including ISC2 and ISACA, sets its own rules, so check with yours first.

What if I need to train a team?

Teams of 3 to 4 get 10% off, and teams of 5 to 9 get 20% off. For 10 or more, ask for a quote. Email [email protected] to set it up.

Ready to make your pipeline prove itself?

Start with the 3-hour Fast Path, or work through all 15 modules at your own pace. Finish the course and have your capstone approved to earn a certificate for 10 hours of training. Training a team of three or more? Email [email protected] for team pricing.

$249.00

Enroll now Free preview