# slsa

Supply-chain Levels for Software Artifacts (LinkML)

> **Only want to ask?** Install `ktl-docent` into any agent you use, by a route from [the install page](https://w3id.org/ktl/docs/install/), and ask it about this project. It answers from the bundle and says how far each answer has been checked.
>
> **Agents:** if `.lokf/knowledge/index.md` exists, read it first. `llms.txt` says how to weigh it.

## Documentation Website

[https://lmodel.github.io/slsa](https://lmodel.github.io/slsa)

## What it models

The [SLSA specification](https://slsa.dev/spec/v1.2/), version 1.2: the Build and Source tracks, the build provenance and Verification Summary Attestation predicates, and the roles, build platform and package model. The in-toto statement layer they sit in comes from [lmodel/in-toto](https://github.com/lmodel/in-toto)'s core module, vendored in [src/slsa/schema/in_toto/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/src/slsa/schema/in_toto). The Dependency and Build Environment tracks follow the working draft at 1.2. The schema's `version` is 1.2.0, the copy in [src/slsa/schema/spec/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/src/slsa/schema/spec) matches the `v1.2` tag, and a weekly workflow opens an issue when the SLSA Working Group tags a newer version.

## Influences

Two sources add elements of their own, each in a subset: the CNCF *Secure Software Factory* whitepaper (`slsa_ssf`) and the SLSA adoption study by Tamanna et al. (`slsa_adoption_study`). [docs/about.md](https://lmodel.github.io/slsa/docs/about/) says what each adds.

## Mappings

None. The schema declares no mappings to other vocabularies.

## Repository Structure

* [docs/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/docs): the documentation pages the website shows
  * [elements/](https://lmodel.github.io/slsa/schema/): generated schema documentation
* [examples/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/examples): examples of using the schema
* [project/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/project): project files (these files are auto-generated, do not edit)
* [src/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/src): source files (edit these)
  * [slsa](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/src/slsa)
    * [schema/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/src/slsa/schema): the LinkML schema, `slsa.yaml` and
      the modules it imports (edit these)
    * [datamodel/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/src/slsa/datamodel): generated
      Python datamodel
* [tests/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/tests): Python tests
  * [data/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/tests/data): example data
* [website/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/website): the documentation website, an Astro Starlight site built from the README, `docs/`, the schema's pages and the knowledge bundle

## Developer Tools

Several pre-defined command-recipes are available using [just](https://github.com/casey/just/). To see the list, run `just` or `just --list`.

## Knowledge Trust Ladder (KTL)

`.lokf/` holds this project's [KTL](https://w3id.org/ktl/) knowledge bundle. Its domain schema is `.lokf/slsa.yaml`, a copy that `lokf adapt` wrote from `src/slsa/schema/slsa.yaml`. Edit the source, never the copy.

`just lokf-adapt` rewrites the copy and `just lokf-adapt-check` says when it is stale; `project.justfile` says which classes the copy roots on `Concept`. A concept may name any of them, or a subclass, as its `type`. Obsidian users of the KTL Registrar and KTL Curator plugins should add them to the *Known LOKF types* setting:

```text
SlsaProducer, SlsaConsumer, SlsaVerifier, SlsaInfrastructureProvider, SlsaBuildImageProducer, SlsaBuildPlatform, SlsaControlPlane, SlsaPackage, SlsaPackageRegistry, SlsaSourceControlSystem, SlsaSourceRepository, SlsaSourceRevision, SlsaBuildImage
```

In the copy, LOKF's `id` stands in for each class's own identifier (`builder_id`, `repository_uri` and the like), so a concept writes `id`. Two slots are renamed in the copy, because LOKF 0.9.0 defines slots of the same names: `revision` is `slsa_revision`, with its IRI still `slsa:revision`, and a statement's `predicate` is `slsa_predicate`, with in-toto's IRI. A slsa document keeps both keys. Every other key keeps its name, because no other top-level class, slot, enum or type in the schema has a name that `lokf.yaml` defines. `lokf adapt` does not compare class attributes, so `media_type` keeps the name it shares with a LOKF slot, and takes that slot's IRI, `dcat:mediaType`.

## License

The schema and the code are under the Apache License 2.0 ([LICENSE](https://github.com/lmodel/slsa/blob/e8e11420daf5453be29320249e17697a9310e2d4/LICENSE)).

The repository also carries the specification's pages in [src/slsa/schema/spec/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/src/slsa/schema/spec) and the CNCF Secure Software Factory whitepaper in [docs/](https://github.com/lmodel/slsa/tree/e8e11420daf5453be29320249e17697a9310e2d4/docs), each under its own license. See [NOTICE](https://github.com/lmodel/slsa/blob/e8e11420daf5453be29320249e17697a9310e2d4/NOTICE).

This is not an official SLSA release, and its use does not imply endorsement by the SLSA Working Group, OpenSSF or the CNCF.

## Contributing and security

[CONTRIBUTING.md](https://github.com/lmodel/slsa/blob/e8e11420daf5453be29320249e17697a9310e2d4/CONTRIBUTING.md) is the checklist for a pull request and
for releasing. [AI_COVENANT.md](https://github.com/lmodel/slsa/blob/e8e11420daf5453be29320249e17697a9310e2d4/AI_COVENANT.md) sets the rules for AI-assisted
work. [SECURITY.md](https://github.com/lmodel/slsa/blob/e8e11420daf5453be29320249e17697a9310e2d4/SECURITY.md) says how to report a vulnerability.
[CHANGELOG.md](https://github.com/lmodel/slsa/blob/e8e11420daf5453be29320249e17697a9310e2d4/CHANGELOG.md) records the changes.

## Credits

This project uses the template [linkml-project-copier](https://github.com/dalito/linkml-project-copier) published as [doi:10.5281/zenodo.15163584](https://doi.org/10.5281/zenodo.15163584).