SLSA
Supply chain Levels for Software Artifacts (SLSA) is a software supply-chain security framework that defines a tiered set of standards for measuring the security and integrity of software build processes. It helps ensure that software artifacts originate from trusted sources and that build processes are independently verifiable.
Core Facts
Timeline (last 90 days)
Git provides strong traceability through commit hashes, signatures, and immutable history, which is also the foundation recommended by frameworks such as SLSA.
The 2021 SolarWinds incident and the 2022 node-ipc poisoning incident drove the adoption of the SLSA framework.
Model training is inherently non-deterministic—running the same code and the same data twice may produce different weights—making the build reproducibility required by higher SLSA levels difficult to satisfy in ML scenarios.
SLSA's Provenance format is built on the in-toto Attestation specification, and the two are not mutually exclusive.
The SLSA framework and the Sigstore project are dedicated to providing verifiable provenance attestations for build and release pipelines.
Docket's approach is similar to SBOM or the SLSA framework in the software supply chain security space, but answers which agent generated a commit, under what context, and through what verification steps.
SLSA's L3 level requires that the build environment have tamper-resistance capabilities, while L4 is currently a theoretical standard requiring recursive review of all dependencies and two-party auditing.
The SLSA (Supply-chain Levels for Software Artifacts) framework provides a security level assessment system ranging from L1 to L4 for software build processes.
The SLSA framework was proposed by Google in 2021 and divides software supply chain security into four levels.
SLSA框架（Supply-chain Levels for Software Artifacts）要求对每个构建产物提供可验证的来源证明
1 more timeline events
All Facts (12)
The SLSA (Supply-chain Levels for Software Artifacts) framework, led by Google, divides software supply chain security capabilities into four levels.
65%UnverifiedThe SLSA framework was proposed by Google in 2021 and divides software supply chain security into four levels.
70%UnverifiedGit provides strong traceability through commit hashes, signatures, and immutable history, which is also the foundation recommended by frameworks such as SLSA.
50%UnverifiedModel training is inherently non-deterministic—running the same code and the same data twice may produce different weights—making the build reproducibility required by higher SLSA levels difficult to satisfy in ML scenarios.
50%UnverifiedSLSA's Provenance format is built on the in-toto Attestation specification, and the two are not mutually exclusive.
50%UnverifiedThe SLSA framework and the Sigstore project are dedicated to providing verifiable provenance attestations for build and release pipelines.
50%UnverifiedDocket's approach is similar to SBOM or the SLSA framework in the software supply chain security space, but answers which agent generated a commit, under what context, and through what verification steps.
50%UnverifiedSLSA's L3 level requires that the build environment have tamper-resistance capabilities, while L4 is currently a theoretical standard requiring recursive review of all dependencies and two-party auditing.
50%UnverifiedThe SLSA (Supply-chain Levels for Software Artifacts) framework provides a security level assessment system ranging from L1 to L4 for software build processes.
50%UnverifiedSLSA框架（Supply-chain Levels for Software Artifacts）要求对每个构建产物提供可验证的来源证明
50%UnverifiedThe SLSA framework defines progressive security levels from Level 1 to Level 4; Level 3 and above require the build process to be executed in an isolated environment with unforgeable provenance attestation.
50%UnverifiedThe 2021 SolarWinds incident and the 2022 node-ipc poisoning incident drove the adoption of the SLSA framework.
50%