SLSA

SLSA (pronounced “salsa”) is a security framework, originally from Google and now hosted by the OpenSSF — the Open Source Security Foundation, a Linux Foundation project that funds and coordinates open-source security work — that describes how to make the build process for a software artifact trustworthy. Where an SBOM tells you what is inside an artifact, SLSA is concerned with where the artifact came from and whether that origin can be verified.

Its central artifact is provenance: signed, machine-readable metadata stating what was built, from which sources, by which builder, and with what inputs. Given provenance, a consumer can verify that the binary they are about to deploy really was produced by the pipeline they trust, from the commit they think it was.

SLSA defines Build Levels of increasing rigor. Broadly: Level 1 requires that provenance exists; Level 2 that it is signed by a hosted build service; Level 3 that the build runs on hardened infrastructure resistant to tampering by the build itself. Higher levels are about the strength of the guarantee, not about the amount of documentation.

The threat SLSA addresses is the compromised build system — an attacker who does not touch your source code but alters what your pipeline produces from it. SolarWinds is the canonical example. Provenance is normally signed with a tool such as Cosign.