tutorial

Monitoring SLSA (Supply-chain Levels for Software Artifacts) with Vigilmon

SLSA is a NIST-aligned security framework and toolset for establishing and verifying software build integrity — but provenance generation failures, attestation verification gaps, and level-compliance regressions are silent until someone audits your supply chain. Here's how to monitor SLSA tooling availability, provenance generation, attestation verification, and level compliance with Vigilmon.

SLSA (Supply-chain Levels for Software Artifacts, pronounced "salsa") is an open framework backed by Google, the CNCF, and OpenSSF that defines four increasingly rigorous levels of build integrity assurance — from basic source version control (L1) through hermetic, reproducible builds with verified provenance (L4). The SLSA toolchain generates signed provenance attestations at build time (recording what was built, from what source, and by which builder), and verifies those attestations downstream before artifacts are deployed or consumed. When provenance generation silently fails during a CI run, when the verification sidecar crashes inside a Kubernetes admission controller, or when a dependency upgrade regresses your SLSA level, your supply chain guarantees disappear without any visible error — an attacker who compromises the build system would find no attestation check standing in their way. Vigilmon gives you external monitoring for SLSA tooling process health, provenance generation success rates, attestation verification availability, and level-compliance drift so you know immediately when your software supply chain integrity assurance breaks down.

What You'll Set Up

  • SLSA provenance generator health via cron heartbeats
  • Provenance generation success rate monitoring per build pipeline
  • Attestation store (Rekor / in-toto) reachability checks
  • SLSA Verifier availability and policy compliance
  • Level-regression detection across your artifact inventory

Prerequisites

  • SLSA toolchain installed: slsa-verifier, slsa-github-generator or equivalent builder
  • Access to your CI pipeline logs or a log aggregation endpoint
  • Rekor transparency log endpoint (public https://rekor.sigstore.dev or self-hosted)
  • Optional: cosign CLI for attestation verification steps
  • A free Vigilmon account

Step 1: Monitor Provenance Generator Process Health

The SLSA provenance generator runs as a step inside your CI pipeline — whether that is the official slsa-github-generator reusable workflow, the slsa-buildkite-plugin, or a custom slsa-runner binary. When this step is silently skipped, crashes without failing the overall build, or is excluded by a misconfigured workflow condition, your artifacts ship without provenance. Monitor generation health with a heartbeat that fires only when provenance is successfully produced:

  1. In Vigilmon, click Add Monitor → Cron Heartbeat.
  2. Set Expected ping interval to 30 minutes (or match your build cadence).
  3. Copy the heartbeat URL (e.g., https://vigilmon.online/heartbeat/abc123).

Add a provenance success ping to your CI step:

# .github/workflows/release.yml (GitHub Actions example)
jobs:
  build:
    # ... your existing build steps ...

  provenance:
    needs: [build]
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"

  notify-monitoring:
    needs: [provenance]
    runs-on: ubuntu-latest
    if: success()
    steps:
      - name: Ping Vigilmon heartbeat
        run: curl -s "https://vigilmon.online/heartbeat/abc123"

For non-GitHub CI systems, wrap the provenance generator in a shell script:

#!/bin/bash
# /usr/local/bin/slsa-provenance-generate.sh

HEARTBEAT_URL="https://vigilmon.online/heartbeat/abc123"
ARTIFACT_PATH="${1:?Usage: $0 <artifact-path>}"
OUTPUT_DIR="${2:-./provenance}"

mkdir -p "$OUTPUT_DIR"

# Run slsa-runner or your provenance generator
if slsa-runner generate \
    --artifact "$ARTIFACT_PATH" \
    --output "$OUTPUT_DIR/provenance.json" \
    --builder-id "https://your-ci.internal/slsa-builder" 2>&1; then

  # Verify the generated provenance before pinging healthy
  if [ -s "$OUTPUT_DIR/provenance.json" ]; then
    echo "Provenance generated: $OUTPUT_DIR/provenance.json"
    curl -s "$HEARTBEAT_URL"
  else
    echo "Provenance file is empty — generation may have silently failed"
    exit 1
  fi
else
  echo "Provenance generation failed"
  exit 1
fi

If the heartbeat stops arriving within the expected window, Vigilmon alerts you — a missing ping means either no build ran (check your CI schedule) or provenance generation is broken.

Step 2: Monitor Rekor Transparency Log Reachability

SLSA provenance attestations are published to a transparency log — most commonly Sigstore's Rekor — so that third parties can independently verify your build integrity claims. If Rekor is unreachable during your build pipeline, provenance upload fails silently in many configurations; if Rekor is unreachable during verification, your admission controller or deployment gate can either reject all deployments or (worse) fail open and allow unverified artifacts through. Monitor Rekor reachability explicitly:

#!/bin/bash
# /usr/local/bin/rekor-health-check.sh

HEARTBEAT_URL="https://vigilmon.online/heartbeat/def456"
REKOR_URL="${REKOR_URL:-https://rekor.sigstore.dev}"
TIMEOUT=10

# Check Rekor API health endpoint
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
  --max-time "$TIMEOUT" \
  "${REKOR_URL}/api/v1/log")

if [ "$HTTP_CODE" = "200" ]; then
  # Verify the log is returning a valid tree size (not a stale/frozen log)
  TREE_SIZE=$(curl -s --max-time "$TIMEOUT" \
    "${REKOR_URL}/api/v1/log" | \
    python3 -c "import sys, json; d=json.load(sys.stdin); print(d.get('treeSize', 0))" 2>/dev/null || echo 0)

  if [ "$TREE_SIZE" -gt 0 ]; then
    echo "Rekor healthy: tree size $TREE_SIZE at ${REKOR_URL}"
    curl -s "$HEARTBEAT_URL"
  else
    echo "Rekor API returned 200 but tree size is 0 — log may be frozen"
    exit 1
  fi
else
  echo "Rekor unreachable: HTTP $HTTP_CODE at ${REKOR_URL}"
  exit 1
fi

Install as a cron job running every 5 minutes:

chmod +x /usr/local/bin/rekor-health-check.sh
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/local/bin/rekor-health-check.sh >> /var/log/rekor-health.log 2>&1") | crontab -

For self-hosted Rekor deployments, also monitor the backing storage (e.g., Trillian log server) and the Rekor signer key availability separately.

Step 3: Monitor SLSA Verifier Availability

slsa-verifier is the CLI tool that consumes SLSA provenance and checks it against a policy (expected builder, source repository, artifact digest). It runs as a gate in deployment pipelines, Kubernetes admission controllers, and CI promotion workflows. If the verifier binary is missing, misconfigured, or encounters a library dependency error, deployments either fail entirely or — in permissive configurations — proceed without verification. Monitor the verifier's ability to execute and produce valid output:

#!/bin/bash
# /usr/local/bin/slsa-verifier-health-check.sh

HEARTBEAT_URL="https://vigilmon.online/heartbeat/ghi789"
VERIFIER_BIN="${SLSA_VERIFIER_BIN:-slsa-verifier}"
TEST_ARTIFACT_PATH="/var/lib/slsa-monitoring/test-artifact.tar.gz"
TEST_PROVENANCE_PATH="/var/lib/slsa-monitoring/test-provenance.json"
TEST_SOURCE_URI="https://github.com/your-org/your-repo"
TEST_BUILDER_ID="https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v2.0.0"

# Verify slsa-verifier binary is present and executable
if ! command -v "$VERIFIER_BIN" &>/dev/null; then
  echo "slsa-verifier not found in PATH"
  exit 1
fi

# Check the verifier can output its version (basic executable test)
VERSION=$("$VERIFIER_BIN" version 2>&1 | head -1)
if [ -z "$VERSION" ]; then
  echo "slsa-verifier produced no version output — binary may be broken"
  exit 1
fi

# If test artifacts exist, run a real verification
if [ -f "$TEST_ARTIFACT_PATH" ] && [ -f "$TEST_PROVENANCE_PATH" ]; then
  VERIFY_OUTPUT=$("$VERIFIER_BIN" verify-artifact \
    --provenance-path "$TEST_PROVENANCE_PATH" \
    --source-uri "$TEST_SOURCE_URI" \
    --builder-id "$TEST_BUILDER_ID" \
    "$TEST_ARTIFACT_PATH" 2>&1)

  if echo "$VERIFY_OUTPUT" | grep -q "PASSED"; then
    echo "slsa-verifier OK: $VERSION — verification passed on test artifact"
    curl -s "$HEARTBEAT_URL"
  else
    echo "slsa-verifier verification failed on test artifact:"
    echo "$VERIFY_OUTPUT"
    exit 1
  fi
else
  # Binary exists and responds — basic health confirmed
  echo "slsa-verifier OK: $VERSION (no test artifact available for full check)"
  curl -s "$HEARTBEAT_URL"
fi

Set the Vigilmon heartbeat to 10 minutes. For Kubernetes deployments using SLSA as an admission controller policy, also run this check from inside the cluster via a Kubernetes CronJob so you catch permission or network issues specific to the in-cluster execution context.

Step 4: Monitor Provenance Generation Success Rate

A provenance generator that fails on 20% of builds is worse than no generator at all — it creates a false sense of security for the 80% of artifacts that do have provenance while the other 20% slip through unverified. Track generation success rates by parsing CI logs or by maintaining a counter in a lightweight key-value store:

#!/bin/bash
# /usr/local/bin/slsa-success-rate-check.sh

HEARTBEAT_URL="https://vigilmon.online/heartbeat/jkl012"
METRICS_FILE="/var/lib/slsa-monitoring/metrics.json"
MIN_SUCCESS_RATE=95   # Alert if fewer than 95% of builds produce provenance
LOOKBACK_BUILDS=50    # Check the last 50 builds

# Read CI pipeline logs or a metrics file maintained by your build system
# This example reads from a simple JSON file updated by each build
if [ ! -f "$METRICS_FILE" ]; then
  echo "Metrics file not found: $METRICS_FILE"
  exit 1
fi

RESULT=$(python3 -c "
import json, sys

with open('$METRICS_FILE') as f:
    data = json.load(f)

builds = data.get('builds', [])[-$LOOKBACK_BUILDS:]
if not builds:
    print('NO_DATA')
    sys.exit(0)

total = len(builds)
success = sum(1 for b in builds if b.get('provenance_generated'))
rate = int(success * 100 / total)
print(f'{rate} {success} {total}')
" 2>/dev/null)

if [ "$RESULT" = "NO_DATA" ] || [ -z "$RESULT" ]; then
  echo "No build data available yet — skipping rate check"
  curl -s "$HEARTBEAT_URL"
  exit 0
fi

read -r RATE SUCCESS TOTAL <<< "$RESULT"

if [ "$RATE" -ge "$MIN_SUCCESS_RATE" ]; then
  echo "Provenance generation rate OK: ${RATE}% (${SUCCESS}/${TOTAL} builds)"
  curl -s "$HEARTBEAT_URL"
else
  echo "Provenance generation rate LOW: ${RATE}% (${SUCCESS}/${TOTAL} builds) — min: ${MIN_SUCCESS_RATE}%"
  exit 1
fi

Maintain the metrics file from your CI system by appending a JSON record after each build. For GitHub Actions, use the Deployments API or a repository dispatch event to write the record; for Jenkins, use a post-build script; for GitLab, use a downstream pipeline trigger with artifact passing.

Step 5: Detect SLSA Level Regressions

SLSA level regressions happen when a build pipeline change removes a required attestation step, when a dependency upgrade introduces a builder that does not meet the required level, or when the CI configuration changes in a way that bypasses the provenance generator. Monitor your artifact inventory for level regressions by periodically verifying the SLSA level of recently published artifacts:

#!/bin/bash
# /usr/local/bin/slsa-level-check.sh

HEARTBEAT_URL="https://vigilmon.online/heartbeat/mno345"
REGISTRY="ghcr.io"
IMAGE_REF="${REGISTRY}/your-org/your-image:latest"
REQUIRED_SLSA_LEVEL=3
REKOR_URL="https://rekor.sigstore.dev"
SOURCE_URI="https://github.com/your-org/your-repo"

# Use cosign to fetch attestations and check SLSA level
ATTESTATIONS=$(cosign verify-attestation \
  --type slsaprovenance \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate-identity-regexp "https://github.com/slsa-framework/slsa-github-generator" \
  "$IMAGE_REF" 2>&1)

if echo "$ATTESTATIONS" | grep -q "Verification for"; then
  # Extract SLSA build level from the provenance payload
  DETECTED_LEVEL=$(echo "$ATTESTATIONS" | \
    python3 -c "
import sys, json

for line in sys.stdin:
    line = line.strip()
    if not line.startswith('{'):
        continue
    try:
        obj = json.loads(line)
        payload = obj.get('payload', '')
        if payload:
            import base64
            decoded = json.loads(base64.b64decode(payload + '=='))
            pred = decoded.get('predicate', {})
            build_def = pred.get('buildDefinition', {})
            # SLSA v1.0 buildType encodes the level
            build_type = build_def.get('buildType', '')
            if 'slsa_github_generator' in build_type or 'generic_slsa3' in build_type.lower():
                print(3)
            elif 'generic_slsa2' in build_type.lower():
                print(2)
            elif 'generic_slsa1' in build_type.lower():
                print(1)
            else:
                print(0)
            sys.exit(0)
    except:
        pass
print(0)
" 2>/dev/null || echo 0)

  if [ "$DETECTED_LEVEL" -ge "$REQUIRED_SLSA_LEVEL" ]; then
    echo "SLSA level OK: detected L${DETECTED_LEVEL} >= required L${REQUIRED_SLSA_LEVEL} for ${IMAGE_REF}"
    curl -s "$HEARTBEAT_URL"
  else
    echo "SLSA LEVEL REGRESSION: detected L${DETECTED_LEVEL} < required L${REQUIRED_SLSA_LEVEL} for ${IMAGE_REF}"
    exit 1
  fi
else
  echo "No SLSA attestation found for ${IMAGE_REF} — artifact may be unattested"
  exit 1
fi

Run this check every 30 minutes (matching your release cadence) with a Vigilmon heartbeat at 45 minutes. A level regression alert means a recently published artifact does not meet your supply chain policy — trigger a rollback or block downstream consumers until the build pipeline is corrected.

Step 6: Set Up Alert Channels

Configure Vigilmon to route SLSA monitoring alerts to your security and platform engineering teams:

  1. Go to Alert Channels in Vigilmon.
  2. Add a Slack webhook to #supply-chain-security — provenance failures are high-severity security events.
  3. Add PagerDuty for the Rekor reachability and SLSA level regression monitors — these represent active supply chain integrity failures.
  4. Add email notification for the success rate monitor — gradual rate decay (95% → 90% → 85%) warrants investigation but not an immediate page.
  5. Set Consecutive failures before alert to 1 for level regression checks — a single failing check means an artifact is in production without required provenance.

Include artifact context in your alerts so the security team can immediately identify which release is affected:

ARTIFACT_REF="ghcr.io/your-org/your-image:v1.2.3"
DETECTED_LEVEL=1
REQUIRED_LEVEL=3
ALERT_MSG="*SLSA Level Regression* — ${ARTIFACT_REF} is at L${DETECTED_LEVEL}, required L${REQUIRED_LEVEL}. Block deployments from this image until provenance is regenerated."

curl -X POST https://hooks.slack.com/services/YOUR/WEBHOOK/URL \
  -H 'Content-type: application/json' \
  --data "{\"text\": \"$ALERT_MSG\", \"channel\": \"#supply-chain-security\"}"

Add maintenance windows during SLSA toolchain upgrades:

curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "monitor_id": "SLSA_MONITOR_ID",
    "duration_minutes": 15,
    "reason": "slsa-github-generator version upgrade"
  }'

Summary

| Monitor | Target | What It Catches | |---|---|---| | Cron heartbeat (provenance generator) | CI pipeline provenance step | Silent provenance generation failures | | Cron heartbeat (Rekor reachability) | Rekor API /api/v1/log | Transparency log outage, fail-open risk | | Cron heartbeat (verifier health) | slsa-verifier version + test artifact | Missing binary, broken verification gate | | Cron heartbeat (success rate) | Build metrics JSON | Systematic provenance generation failures | | Cron heartbeat (level regression) | cosign verify-attestation on latest image | Level downgrade from pipeline changes |

SLSA's failure mode is invisible degradation — the build system keeps producing artifacts, your CI goes green, but the supply chain integrity guarantees that SLSA is supposed to provide quietly disappear. No external alert fires, no dashboard turns red, and an attacker who compromises your build environment during the gap finds no attestation check blocking them. Vigilmon's external monitoring fills that gap: you know immediately when provenance stops being generated, when the verification gate goes offline, or when an artifact regresses to a lower SLSA level.

Start monitoring for free at vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles