SLSA Conformance
summary
SLSA 1.0 defines build levels 1–3 with concrete producer and build-platform requirements: producers must pick a compatible builder, keep a consistent process, and publish provenance; platforms must provide authenticity at L2 and unforgeable provenance plus isolated builds and key protection (KMS/HSM or Sigstore) at L3. The conformance proposal creates a public registry and a two‑tier program — self-certification then third-party audits — with auditors publishing procedures and reports; examples include running Fresca on Kubernetes to reach L2/L3.
AI-written summary · about
chapters (4)
related talks
15mAn Overview on SLSA
14mSLSA - A supply chain security framework
29mMake Your CI More Secure and Less Spicy with SLSA
59mIntroduction to SLSA
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
22mFrom Mild To Wild: How Hot Can Your SLSA Be?
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
42mLessons Learned from Automating SLSA-Compliance Evaluation