What it covers. SLSA is an open framework, hosted by the Open Source Security Foundation, for improving the integrity of software artefacts. Version 1.0 defines a build track with increasing levels that focus on producing provenance, a verifiable record of how and from what an artefact was built, and on hardening the build platform against tampering.
In practice. Organisations generate signed provenance for their builds, use hosted or hardened build systems that isolate builds from each other and from developers, and verify provenance before deploying or consuming artefacts. Evidence includes provenance attestations, build platform configuration, verification policies at deployment and a record of which level each product meets.
Common gaps. Provenance is often generated but never verified by consumers, which removes most of its value. Build systems may also allow manual steps or shared credentials that undermine the claimed level.