Simple definition
SLSA, Supply-chain Levels for Software Artifacts, is a framework for increasing trust in software sources and artifact production.
Purpose and use
It helps define expected provenance guarantees and protections for the process that produces or prepares software.
How does it work?
Requirements are organized into tracks and levels. Provenance can establish who built an artifact, using which inputs and under which expected process.
Key points
- Example: a deployment pipeline rejects an artifact whose attestation does not match an authorized builder or repository.
- Specify the SLSA version, track and assessed level, then verify attestations and the controls actually implemented.
Points to watch
An attestation alone does not guarantee vulnerability-free code. Levels from different versions or tracks should not be treated as equivalent without review.
In short
SLSA structures verifiable software-production guarantees beyond a file signature alone.