SLSA level

SLSA level

A level is a step within one track. The specification copy’s about.md says that within each track, ascending levels indicate increasingly hardened security practices. Higher levels give better guarantees against supply chain threats but cost more to implement. Lower levels are easier to adopt but give only modest guarantees.

The specification copy defines these levels:

• Build L0 to L3 (build-track-basics.md): L0 has no requirements. L1 needs provenance showing how the package was built. L2 needs signed provenance generated by a hosted build platform. L3 needs a hardened build platform.
• Source L1 to L4 (source-requirements.md): L1 uses a version control system. L2 preserves change history and generates source provenance. L3 enforces organizational technical controls. L4 requires code review. A revision for which the source control system issues no verification summary attestation has Source Level 0.
• Dependency L0 to L4 (dependency-track.md): The levels run from no requirements, through an inventory of dependencies and triaged known vulnerabilities, to dependencies consumed from sources under the producer’s control, and proactive defence against upstream attacks.
• BuildEnv L0 to L3 (build-env-track-basics.md): L0 has no requirements. L1 needs signed build image provenance. L2 needs an attested build environment instantiation. L3 needs a hardware-attested build environment.

The schema encodes the levels as enum values in four enums: SlsaBuildLevel, SlsaSourceLevel, SlsaDependencyLevel and SlsaBuildEnvironmentLevel. For example, SlsaBuildLevel runs from SLSA_BUILD_LEVEL_0 to SLSA_BUILD_LEVEL_3, and SlsaBuildEnvironmentLevel from SLSA_BUILD_ENV_LEVEL_0 to SLSA_BUILD_ENV_LEVEL_3.