SLSA
Supply-chain Levels for Software Artifacts
A framework of tracks and levels describing increasingly strong guarantees about how an artifact was built and, since version 1.2, about its source. A level claim needs provenance that a verifier checks.
- Defined in
- SLSA specification 1.2
Covered in
Read SLSA provenance and verify the claim you need
Connect an artifact to its build evidence while distinguishing provenance, build assurance and source controls.
Protect the source repository: rulesets, reviews and signed commits
Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.
Protect the path from pull request to release
Separate untrusted contribution checks from privileged release work and verify the identity of the artifact that is actually deployed.
Practice: Local project: Build and verify a signed software release