Also known as: Supply-chain Levels for Software Artifacts
SLSA (Supply-chain Levels for Software Artifacts) is a security framework that defines graduated levels of build integrity, describing increasingly rigorous requirements for how software artifacts are produced and verified.
SLSA is structured as levels precisely because supply chain security is otherwise an unbounded problem. Each level specifies concrete requirements — scripted builds, provenance generation, isolated build environments, hermetic builds — so an organisation can state where it stands and what the next step is.
Its core insight is that trusting an artifact should not require trusting the person who uploaded it. Verifiable provenance links a binary back to the exact source revision and build process that produced it.
Software Supply Chain Security
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.
SBOM
An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component and dependency contained in a piece of software, including version numbers and licence information.
Code Signing
Code signing is the practice of cryptographically signing software artifacts so that recipients can verify who produced them and confirm the code has not been altered since signing.
Reproducible Build
A reproducible build is one where compiling the same source code with the same environment always produces a byte-for-byte identical binary, allowing anyone to independently verify that a distributed binary genuinely corresponds to its published source.