SLSA

SLSA, or Supply-chain Levels for Software Artifacts, is a security framework that defines a set of maturity levels for the integrity of software artifacts throughout the supply chain. It aims to help organizations establish verifiable provenance and controlled build processes, increasing confidence that artifacts are as claimed. The framework originated in the software security community led by Google and has evolved within the Sigstore project under the Cloud Native Computing Foundation.

SLSA centers on provenance, reproducible builds, and attestations. Provenance records the sources, build steps, and tooling used to create an artifact. Reproducible builds ensure the same input produces the same output. Attestations provide independently verifiable statements about an artifact’s properties, such as provenance, tests, or compliance. The model is designed to be compatible with software bill of materials (SBOMs) and existing signing and verification tooling.

Levels in SLSA typically range from 0 to 4, with higher levels requiring more rigorous controls and evidence. As levels increase, requirements expand to stronger build environments, stricter provenance, and more comprehensive attestations. The framework is intended for integration into modern CI/CD pipelines and packaging workflows, enabling automated verification of an artifact’s trusted provenance before deployment.

Support and tooling around SLSA are part of the broader Sigstore ecosystem, including signing and transparency tooling that can generate and validate provenance, attestations, and SBOM data. Adoption is seen in both open-source and commercial projects seeking to improve supply chain security.