SLSA level
also: SLSA, Supply Chain Levels for Software Artifacts
SLSA (Supply Chain Levels for Software Artifacts) is a framework that defines security maturity levels for software supply chains, ranging from level 1 (basic) to level 4 (highest assurance), helping organizations prevent tampering and improve artifact integrity.
SLSA is a Google-originated framework that provides concrete, measurable security practices to protect software artifacts and source code from tampering and unauthorized modification. It defines four levels of increasing rigor: Level 1 focuses on basic practices like version control and change tracking; Level 2 adds requirements for automated builds and provenance; Level 3 demands hardened build environments and further access controls; Level 4 represents the highest assurance with additional protections like bit-for-bit reproducibility.
Each level builds on the previous one, allowing organizations to incrementally improve their supply chain security posture. For example, a project might start at SLSA 1 by using Git for version control, then advance to SLSA 2 by implementing automated CI/CD pipelines that produce signed build attestations, and eventually reach higher levels by sandboxing builds and eliminating human access to production artifacts.
SLSA is particularly relevant for Linux distributions and open-source projects that need to demonstrate supply chain integrity to users and maintain trust in their artifacts.