Skip to content
SLSA

Enum: SlsaDependencyLevel

The levels of the SLSA Dependency track, each reducing the risk third-party dependencies bring.

URI: slsa:SlsaDependencyLevel

Permissible Values

Section titled “Permissible Values”
Value Meaning Description
SLSA_DEPENDENCY_LEVEL_0 None No Dependency track claims
SLSA_DEPENDENCY_LEVEL_1 None An inventory of all build dependencies, direct and transitive, exists
SLSA_DEPENDENCY_LEVEL_2 None Every known vulnerability in the dependencies was triaged before release
SLSA_DEPENDENCY_LEVEL_3 None Every third-party build dependency is consumed from a location the producer c…
SLSA_DEPENDENCY_LEVEL_4 None An ingestion policy keeps compromised upstream dependencies out of the build

Slots

Section titled “Slots”
Name Description
dependency_level The SLSA Dependency level the producer’s process meets for this artifact

In Subsets

Section titled “In Subsets”

See Also

Section titled “See Also”

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

LinkML Source

Section titled “LinkML Source”
name: SlsaDependencyLevel
description: The levels of the SLSA Dependency track, each reducing the risk third-party
  dependencies bring.
in_subset:
- slsa_dependency_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/draft/dependency-track#levels
rank: 1000
permissible_values:
  SLSA_DEPENDENCY_LEVEL_0:
    text: SLSA_DEPENDENCY_LEVEL_0
    description: No Dependency track claims.
  SLSA_DEPENDENCY_LEVEL_1:
    text: SLSA_DEPENDENCY_LEVEL_1
    description: An inventory of all build dependencies, direct and transitive, exists.
  SLSA_DEPENDENCY_LEVEL_2:
    text: SLSA_DEPENDENCY_LEVEL_2
    description: Every known vulnerability in the dependencies was triaged before
      release.
  SLSA_DEPENDENCY_LEVEL_3:
    text: SLSA_DEPENDENCY_LEVEL_3
    description: Every third-party build dependency is consumed from a location the
      producer controls.
  SLSA_DEPENDENCY_LEVEL_4:
    text: SLSA_DEPENDENCY_LEVEL_4
    description: An ingestion policy keeps compromised upstream dependencies out of
      the build.