SLSA specification

SLSA specification

SLSA (Supply-chain Levels for Software Artifacts) is a specification for describing and incrementally improving supply chain security, established by industry consensus. It is organized into a series of levels that describe increasing security guarantees, and SLSA track says how the levels sit in tracks. Its home is https://slsa.dev.

docs/about.md says that the schema is a LinkML model of the SLSA specification, version 1.2. It renders the specification’s Build and Source tracks, the build provenance and Verification Summary Attestation predicates, and the roles, build platform and package model the specification defines. The in-toto statement layer they sit in comes from lmodel/in-toto’s core module, which src/slsa/schema/in_toto/in_toto_core.yaml vendors, and SlsaStatement adds SLSA’s fields to its statement. in-toto attestation framework describes that layer. The Dependency and Build Environment tracks follow the working draft at version 1.2, which the release does not include.

The schema header in src/slsa/schema/slsa.yaml agrees. It gives version: 1.2.0 and source: https://slsa.dev/spec/v1.2, and lists https://slsa.dev/spec/v1.2/ under see_also. A comment says that the version is the SLSA specification version the model renders.

A copy of the specification’s pages is kept in this repository: see the SLSA specification copy.

License

The SLSA repository’s README gives two licenses. Content contributed under the Community Specification governance model is under the Community Specification License 1.0. Pre-existing portions from contributors who have not contributed again under that license are under the Apache License 2.0. Section 1.2 of the Community Specification License requires anyone who makes a derivative work to attribute it to the Working Group, naming at minimum the material’s name, version number and source.