SLSA
Supply chain Levels for Software Artifacts (SLSA) is a software supply-chain security framework that defines a tiered set of standards for measuring the security and integrity of software build processes. It helps ensure that software artifacts originate from trusted sources and that build processes are independently verifiable.
Core Facts
GPG signing is a digital signature mechanism based on asymmetric encryption; in GitHub's release workflow, maintainers use a private key to sign release artifacts, and users can verify the signature's validity using a public key.
The SLSA (Supply-chain Levels for Software Artifacts) framework, led by Google, divides software supply chain security capabilities into four levels.
Timeline (last 90 days)
Industry approaches to mitigating platform lock-in include adopting open standards (such as the OCI image format and the SLSA supply chain specification), supporting configuration as code that can be version-controlled externally, and providing data export and API compatibility capabilities.
Signature verification is one of the foundational practices recommended by frameworks such as SLSA, and it can reduce the risk of malicious commits being planted after a code repository is compromised.
Git provides strong traceability through commit hashes, signatures, and immutable history, which is also the foundation recommended by frameworks such as SLSA.
The 2021 SolarWinds incident and the 2022 node-ipc poisoning incident drove the adoption of the SLSA framework.
SLSA's Provenance format is built on the in-toto Attestation specification, and the two are not mutually exclusive.
Model training is inherently non-deterministic—running the same code and the same data twice may produce different weights—making the build reproducibility required by higher SLSA levels difficult to satisfy in ML scenarios.
The SLSA framework and the Sigstore project are dedicated to providing verifiable provenance attestations for build and release pipelines.
Docket's approach is similar to SBOM or the SLSA framework in the software supply chain security space, but answers which agent generated a commit, under what context, and through what verification steps.
SLSA's L3 level requires that the build environment have tamper-resistance capabilities, while L4 is currently a theoretical standard requiring recursive review of all dependencies and two-party auditing.
The SLSA (Supply-chain Levels for Software Artifacts) framework provides a security level assessment system ranging from L1 to L4 for software build processes.
4 more timeline events
All Facts (15)
GPG signing is a digital signature mechanism based on asymmetric encryption; in GitHub's release workflow, maintainers use a private key to sign release artifacts, and users can verify the signature's validity using a public key.
90%VerifiedThe SLSA (Supply-chain Levels for Software Artifacts) framework, led by Google, divides software supply chain security capabilities into four levels.
65%UnverifiedThe SLSA framework was proposed by Google in 2021 and divides software supply chain security into four levels.
70%UnverifiedThe SLSA framework (Supply-chain Levels for Software Artifacts) requires verifiable provenance attestations for each build artifact.
60%UnverifiedIndustry approaches to mitigating platform lock-in include adopting open standards (such as the OCI image format and the SLSA supply chain specification), supporting configuration as code that can be version-controlled externally, and providing data export and API compatibility capabilities.
50%UnverifiedSignature verification is one of the foundational practices recommended by frameworks such as SLSA, and it can reduce the risk of malicious commits being planted after a code repository is compromised.
50%UnverifiedGit provides strong traceability through commit hashes, signatures, and immutable history, which is also the foundation recommended by frameworks such as SLSA.
50%UnverifiedSLSA's Provenance format is built on the in-toto Attestation specification, and the two are not mutually exclusive.
50%UnverifiedModel training is inherently non-deterministic—running the same code and the same data twice may produce different weights—making the build reproducibility required by higher SLSA levels difficult to satisfy in ML scenarios.
50%UnverifiedThe SLSA framework and the Sigstore project are dedicated to providing verifiable provenance attestations for build and release pipelines.
50%UnverifiedDocket's approach is similar to SBOM or the SLSA framework in the software supply chain security space, but answers which agent generated a commit, under what context, and through what verification steps.
50%UnverifiedSLSA's L3 level requires that the build environment have tamper-resistance capabilities, while L4 is currently a theoretical standard requiring recursive review of all dependencies and two-party auditing.
50%UnverifiedThe SLSA (Supply-chain Levels for Software Artifacts) framework provides a security level assessment system ranging from L1 to L4 for software build processes.
50%UnverifiedThe SLSA framework defines progressive security levels from Level 1 to Level 4; Level 3 and above require the build process to be executed in an isolated environment with unforgeable provenance attestation.
50%UnverifiedThe 2021 SolarWinds incident and the 2022 node-ipc poisoning incident drove the adoption of the SLSA framework.
50%