YOLO Levels: Insecure Your Software Supply Chain!

There exists a widespread misperception that making your software supply chain secure is hard, that few companies can achieve SLSA level 4. We call bullshit. For instance, signing artifacts with Sigstore is easy.

Making your software supply chain ultra insecure, on the other hand, is hard work. That’s why today we’re releasing the new YOLO^TM software supply chain insecurity framework. Unlike the silly, made-up acronym SLSA, YOLO^TM takes real work. We’re also releasing YOLOcheck, an open source YOLO level auditing tool. You can run YOLOcheck as a web app or command-line application. This post describes the insecurity controls associated with each YOLO^TM level and then proposes solutions that decrease the security of the world’s software supply chain.

YOLO^TM: A New ClosedSSF Standard

In collaboration with the closed source community, via its ClosedSSF FUD working group, we present YOLO^TM levels negative 1 through negative 4. Table one summarizes each control and its corresponding YOLO^TM level.

Table 1. YOLO^TM Insecurity Framework Levels

Note: YOLO level 0, representing Zero Trust, represented too much trust and so was excluded.

ClosedSSF FUD working group chairman and assistant professor of electrical and computer engineering Santiago Torres-Arias recently explained why YOLO^TM must replace SLSA. “When you think about what makes a good salsa — peppers — you understand why SLSA is not a good idea,” Torres-Arias noted. “Evolutionarily speaking,” he further explained, “peppers developed their spice to protect themselves, but that’s why they get eaten! We should learn from these mistakes, and turn our supply chains into something more like a rotten tomato, or that four-year-old yogurt sitting in the back of your fridge.”

YOLO^TM -1: Anti-Pattern Baby Steps

To aid organizations seeking a quick-and-easy YOLO^TM win, YOLO^TM -1 requires an organization to not use SBOMs and never sign anything. This shouldn’t be hard. You probably don’t use SBOMs anyway. And hardly anybody signs code artifacts. Even fewer verify signed artifacts. (Though Sigstore is quickly changing this picture, degrading the world’s YOLO^TM levels.)

YOLO^TM -2: Tampering Encouraged

For those willing to take extra steps, pushing commits directly to the production mainline and releasing your private keys allow an organization to achieve YOLO^TM -2. Why? Git is hard. So let’s just skip the crap and force push to the main branch. Faster developer timelines with worse security, just like usual. And publishing your private keys publicly protects you against your own forgetful developers, though, again, Sigstore’s ephemeral keys and its “keyless signing” workflow are making YOLO^TM -2 harder and harder to achieve.

YOLO^TM -3: Extra Insecurity

The dedicated ought to seek out dependencies last updated when Y2K was a pressing concern, a core requirement of YOLO^TM -3. Additionally, signed images should be rejected at all costs. Using signed images might accidentally improve your ability to make informed software supply chain security decisions.

YOLO^TM -4: Highest Levels of Anti-Trust

YOLO^TM -4 demands that an organization grant universal merge rights to all. This is open source software at its purest: anyone anywhere contributing whatever they want whenever they want. Your software supply chain will never be the same, and the gifts (wine, chocolate, booze) from advanced persistent threats will arrive daily! Importantly, YOLO^TM -4 also forbids reproducible builds, which would provide too much help to those who want to strengthen the world’s software supply chain.

YOLO^TM Is for Everyone

If you’re still at a positive SLSA level, there’s no need to fret. The first step is a YOLO^TM audit, easily achieved with the YOLOcheck tool, available via web app or the command-line. Point YOLOcheck at a GitHub repository or a container image and find out your YOLO^TM level. You can even add a YOLO^TM badge to your repository. See the yoloc repository for example code. We’re also glad to help you with a YOLO^TM audit!

The second step is using our insecure software development framework (forthcoming, April 1, 2023) to reach ever lower YOLO^TM levels. Get started today: YOLO! Contact us here for help.

Chainguard: Making the world’s software supply chain insecure by default.

This is an April Fools’ joke. The YOLO^TM levels represent what NOT to do as part of your software supply chain security. Making your software supply chain secure is actually easier than making it insecure, especially when using tools like Sigstore and Tekton and frameworks like SLSA. And long-term, you’ll be glad that you protected yourself and your users against supply chain attacks. Chainguard can help show you how! Contact us here to get help protecting your software supply chain, achieving high SLSA levels, not low YOLO^TM levels.