# Chainguard conducts SLSA software supply chain security audit of open source project Git

DevFeed: [Chainguard conducts SLSA software supply chain security audit of open source project Git](<https://devfeed.tech/articles/chainguard-conducts-slsa-software-supply-chain-security-audit-of-open-source-project-git-12934.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-conducts-slsa-software-supply-chain-security-audit-of-open-source-project-git>)

Published: 2023-03-01T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Git](<https://devfeed.tech/topics/git.md>), [slsa levels](<https://devfeed.tech/topics/slsa-levels.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [GitLab](<https://devfeed.tech/topics/gitlab.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-labs](<https://devfeed.tech/tags/chainguard-labs.md>), [git](<https://devfeed.tech/tags/git.md>), [gitlab](<https://devfeed.tech/tags/gitlab.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [open-source-technology-improvement-fund](<https://devfeed.tech/tags/open-source-technology-improvement-fund.md>), [ostif](<https://devfeed.tech/tags/ostif.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [security](<https://devfeed.tech/tags/security.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>)

## AI overview

Chainguard, GitLab, and OSTIF audit Git and git-for-windows using the SLSA framework to examine software supply chain security practices. The article finds that SLSA is a poor fit for Git because Git releases source code rather than built artifacts, while git-for-windows can be assessed through the framework. It also reports that Git's contributor community and existing tooling provide protection consistent with SLSA's goals, despite practices that are not machine-readable or machine-verifiable.

## Source excerpt

Chainguard, GitLab and OSTIF conduct a software supply chain security audit of the open source git project using SLSA levels.