Skip to content
SLSA

References

  • CNCF Secure Software Factory whitepaper checked by automation only, still a draft
    The CNCF TAG-Security Secure Software Factory whitepaper (2022), which describes a pipeline of version control, build service, artifact registry, signing service and policy engine; the schema’s slsa_ssf subset takes five slots from it.

  • in-toto attestation framework nobody has checked this yet, still a draft
    The in-toto attestation framework (spec v1), whose Statement, ResourceDescriptor and DigestSet layers carry SLSA provenance and verification summaries; the schema takes its InToto classes, InTotoPredicate and three field types from lmodel/in-toto’s core module at v0.1.0, vendored unchanged in src/slsa/schema/in_toto/, with every digest algorithm the DigestSet page lists.

  • OpenSSF Supply Chain Integrity Working Group checked by automation only, still a draft
    The OpenSSF Supply Chain Integrity Working Group, whose software supply chain projects include SLSA, Sigstore, GUAC, gittuf and Security Insights; the schema’s guac_uri and security_insights_uri slots point at GUAC and Security Insights.

  • SLSA adoption study (Tamanna et al., 2024) checked by automation only, still a draft
    An empirical study by Tamanna et al. (2024, arXiv:2409.05014) of 1,523 SLSA-related GitHub issues from 233 repositories; the schema’s slsa_adoption module encodes its four challenge and five strategy themes as enums on SlsaAdoptionMetadata.

  • SLSA specification checked by automation only, still a draft
    Supply-chain Levels for Software Artifacts (SLSA), the OpenSSF specification of tracks and levels for supply chain security; the slsa LinkML schema renders version 1.2, its Build and Source tracks, and the working draft’s Dependency and Build Environment tracks.