Skip to content
SLSA

Enum: SlsaBuildLevel

The levels of the SLSA Build track, each adding protection against tampering with the build or its provenance.

URI: slsa:SlsaBuildLevel

Permissible Values

Section titled “Permissible Values”
Value Meaning Description
SLSA_BUILD_LEVEL_0 None No requirements; the absence of SLSA, as for development or test builds
SLSA_BUILD_LEVEL_1 None Provenance exists and shows how the package was built; it prevents mistakes b…
SLSA_BUILD_LEVEL_2 None A hosted platform generates and signs the provenance, so tampering after the …
SLSA_BUILD_LEVEL_3 None A hardened platform prevents runs from influencing one another and keeps sign…

Slots

Section titled “Slots”
Name Description
build_level The highest SLSA Build level the platform’s provenance can meet

In Subsets

Section titled “In Subsets”

See Also

Section titled “See Also”

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

LinkML Source

Section titled “LinkML Source”
name: SlsaBuildLevel
description: The levels of the SLSA Build track, each adding protection against tampering
  with the build or its provenance.
in_subset:
- slsa_build_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/build-track-basics
rank: 1000
permissible_values:
  SLSA_BUILD_LEVEL_0:
    text: SLSA_BUILD_LEVEL_0
    description: No requirements; the absence of SLSA, as for development or test
      builds.
  SLSA_BUILD_LEVEL_1:
    text: SLSA_BUILD_LEVEL_1
    description: Provenance exists and shows how the package was built; it prevents
      mistakes but is easy to forge.
  SLSA_BUILD_LEVEL_2:
    text: SLSA_BUILD_LEVEL_2
    description: A hosted platform generates and signs the provenance, so tampering
      after the build needs an explicit attack.
    comments:
    - Keeping the provenance generator, the verifier and signing tools such as cosign
      working in CI workflows was a common difficulty (Tamanna et al., 2024, CI.2).
  SLSA_BUILD_LEVEL_3:
    text: SLSA_BUILD_LEVEL_3
    description: A hardened platform prevents runs from influencing one another and
      keeps signing material away from build steps, so forging provenance needs an
      exploit.
    comments:
    - Practitioners reported difficulty in generating provenance for the higher levels
      (Tamanna et al., 2024, CI.1).