Skip to content
SLSA

Enum: SlsaSourceLevel

The levels of the SLSA Source track, each adding trust in how a revision was created.

URI: slsa:SlsaSourceLevel

Permissible Values

Section titled “Permissible Values”
Value Meaning Description
SLSA_SOURCE_LEVEL_0 None No Source track guarantees; a revision for which the SCS issues no Source VSA…
SLSA_SOURCE_LEVEL_1 None The source is managed in a version control system, so it has discrete, immuta…
SLSA_SOURCE_LEVEL_2 None Branch history is continuous and retained, and the SCS issues source provenan…
SLSA_SOURCE_LEVEL_3 None The SCS enforces the organization’s technical controls on protected named ref…
SLSA_SOURCE_LEVEL_4 None Two trusted persons agree to every change on protected branches

Slots

Section titled “Slots”
Name Description
source_level The SLSA Source level the SCS asserts for the revision

In Subsets

Section titled “In Subsets”

See Also

Section titled “See Also”

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

LinkML Source

Section titled “LinkML Source”
name: SlsaSourceLevel
description: The levels of the SLSA Source track, each adding trust in how a revision
  was created.
in_subset:
- slsa_source_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/source-requirements#basics
rank: 1000
permissible_values:
  SLSA_SOURCE_LEVEL_0:
    text: SLSA_SOURCE_LEVEL_0
    description: No Source track guarantees; a revision for which the SCS issues no
      Source VSA is at this level.
  SLSA_SOURCE_LEVEL_1:
    text: SLSA_SOURCE_LEVEL_1
    description: The source is managed in a version control system, so it has discrete,
      immutable revisions.
  SLSA_SOURCE_LEVEL_2:
    text: SLSA_SOURCE_LEVEL_2
    description: Branch history is continuous and retained, and the SCS issues source
      provenance for each new revision.
  SLSA_SOURCE_LEVEL_3:
    text: SLSA_SOURCE_LEVEL_3
    description: The SCS enforces the organization's technical controls on protected
      named references and provides evidence of them.
  SLSA_SOURCE_LEVEL_4:
    text: SLSA_SOURCE_LEVEL_4
    description: Two trusted persons agree to every change on protected branches.
    comments:
    - Whether pair or mob programming counts as two-party review is an open question
      (Tamanna et al., 2024, LF.2).