Schema subsets

Schema subsets

slsa_core.yaml defines six subsets, and the schema tags its classes, slots and enums with them through in_subset. Each subset’s description says which part of SLSA or which outside source it covers. An element can belong to several subsets.

• slsa_build_track: the SLSA Build track, which measures the trustworthiness of a build and its provenance.
• slsa_source_track: the SLSA Source track, which measures how source revisions are created and managed.
• slsa_dependency_track: the SLSA Dependency track, a working-draft track for managing risk from third-party dependencies.
• slsa_build_environment_track: the SLSA Build Environment track, a working-draft track for the integrity of the compute environment that runs builds.
• slsa_ssf: elements the schema adds from the CNCF TAG-Security Secure Software Factory reference architecture and the OpenSSF supply-chain projects. It tags five slots and no class.
• slsa_adoption_study: elements the schema adds from the adoption study by Tamanna et al. (2024).

The descriptions of slsa_ssf and slsa_adoption_study say that their elements are not part of the SLSA specification. docs/about.md says the same: two sources add elements that are not SLSA’s, each in a subset of its own.

The four track subsets follow the SLSA tracks. The other two follow the Secure Software Factory whitepaper and the adoption study.