Can an on-prem, air-gapped build platform satisfy SLSA's hosted build platform requirement, and what must you show?

## The confusion worth clearing first 'Hosted' in the SLSA build track is routinely misread as 'bought from a cloud provider'. It is not a procurement statement. It is a statement about **who can influence the thing that vouches for the build**. A build platform is hosted, in the sense that matters, when builds run on a shared service that the projects it builds do not administer and cannot reconfigure. That is what turns a provenance statement from a self-assertion into an observation made by a party other than the one being observed. This matters commercially. Defence, government, medical device and some financial contexts cannot send source to a vendor service at all, and are increasingly asked by customers to demonstrate build-integrity levels anyway. Telling those organisations the ladder is closed to them is wrong, and telling them a machine under a developer's desk qualifies is worse. ## What an on-prem builder must demonstrate - **Operator/user separation.** A small, named group administers the builder. The engineers whose code it builds are not in that group. This is the load-bearing control; everything else follows from it. - **Configuration under change control.** Changes to the builder's own configuration - runner images, credential entitlements, what the provenance generator records - go through review with more than one pair of hands. A build platform whose configuration one insider can silently change produces evidence that one insider can silently author. - **Environments provisioned by the service.** The platform creates the execution environment for each build rather than inheriting whatever a team left running. - **A signing identity the build cannot reach**, so no build can mint statements naming the builder. - **A recorded builder identity** that verifiers can pin in policy, and a documented statement of the platform's posture that a customer or auditor can actually read. ## The insider position this is really about The interesting adversary for an on-prem builder is not remote: it is **a malicious insider with legitimate access to the build floor**, and the asset at risk is the integrity of classified or safety-critical software plus the truth of the record about it. Separation of duties is therefore the whole game. If the person who can commit code can also reconfigure the builder that attests to it, the attestation adds process, not assurance. Two-person control on builder configuration, and a distinct release-approval role, are what an auditor should look for. ## What the air gap does and does not buy An air gap reduces remote attack surface and constrains exfiltration paths. It does nothing for any property in this discussion: an air-gapped builder can still reuse environments between builds, still let a job rewrite the definition it is executing, still mount one credential store into every job. The isolation the build track asks about is **between builds**, not between the estate and the internet. Candidates who answer 'we are air-gapped, so this does not apply' have missed the requirement entirely. ## The honest limit of the in-house case Verification never establishes that a builder deserves trust. A verifier checks that provenance is signed by the builder identity its policy names, and that the recorded source and entry point match what it expects; the decision that *this builder is trustworthy* is made out of band and written into the policy. For a vendor-run platform, an external customer inherits a published posture and, sometimes, third-party audit. For an in-house builder, the trust anchor is your own organisation vouching for itself - which is fine internally and thin as an external argument. So the principal-level judgment is what to do about that gap: - **Make the separation auditable**, so a customer's assessor can test it rather than accept it. - **Attest the platform, not just the artifacts** - document and evidence how environments are provisioned, who administers, how the signing identity is protected, and treat that document as a deliverable. - **Decide where an external anchor is worth the cost.** Some organisations move only the least sensitive build classes to an externally operated platform to obtain third-party-anchored provenance, keeping restricted work in-house. ## How to answer this in an interview Lead with the distinction - hosted is a property, not a purchase - then name the separations you would evidence, then be candid about the residual gap: a self-operated builder is an assurance you extend to yourself, and its external credibility rests on how testable you have made the separation.