SLSA-LEVELS

OpenSSF SLSA framework for supply chain security.

Definition

SLSA 1.0 (2023) Build track: L1 = scripted build, L2 = hosted build platform, L3 = build platform isolation. Provenance attestations in in-toto format. L4 (future). Adopted by Google Container Tools, GitHub Actions, Sigstore. NIST SSDF and EO 14028 compatible.

Origin

Initiated by Google in 2021 ; donated to OpenSSF.

Example in context

GitHub Actions workflow emits a SLSA L3 provenance attestation signed with Cosign.

Related terms

• in-toto — attestation format.