Control frameworks and standards
SLSA
Levels of assurance for how software artifacts are built, to protect the software supply chain.
Official source Published by OpenSSF. Summaries in our own words.
What it is
SLSA (Supply-chain Levels for Software Artifacts) is a framework of levels that describe how trustworthy the build of a software artifact is. It exists to protect against tampering in the software supply chain, for example a compromised build system or a release that does not match its source.
Who it applies to
- Open source maintainers and software vendors that publish packages, containers or binaries
- Platform and DevOps teams running CI/CD pipelines
- Software consumers that want to verify where and how the software they use was built
- Vendors preparing evidence for secure development expectations such as the EU Cyber Resilience Act or NIST SSDF
- Status
- A voluntary, open specification maintained under the OpenSSF. Version 1.0 was released in 2023 and focuses on the build track; further tracks are being developed.
- Enforcement
- Voluntary: there is no certification body. It becomes relevant in practice when customers, package registries or procurement rules ask for signed build provenance.
Key points
- The lowest levels are about producing provenance at all, the higher ones about making it hard to forge
- Higher levels require builds to run on a hosted platform that isolates builds and protects signing material
- Provenance is only useful if someone verifies it, so consumers need tooling and policy too
- SLSA complements, but does not replace, secure coding, dependency management and SBOMs
- Many CI platforms and package ecosystems already offer provenance generation that reaches the lower levels
Where to start
- 1Inventory how your artifacts are built and released
- 2Turn on provenance generation in your CI platform for one important artifact
- 3Move builds to a hosted, isolated build platform to reach higher levels
- 4Add provenance verification to deployment for artifacts you consume
How it is structured
| Build track levels | Levels from no guarantees up to a hardened build platform, each adding stronger protection |
|---|---|
| Provenance | A signed statement of what was built, from which source, by which build platform |
| Verification | Guidance for consumers on checking provenance before using an artifact |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.