SLSA Supply-chain Levels for Software Artifacts
Supply-chain Levels for Software Artifacts (pronounced "salsa") — a framework from Google/OpenSSF for incrementally hardening software's build process against tampering. It defines levels of guarantees that an artifact was actually built from the source and in the way it claims (provenance).
Problem: even if the source code is secure, something can be sneaked into the build step (a compromised build server, a tampered pipeline — like the SolarWinds attack, where the backdoor was injected at build time, not in the code). SLSA focuses on build integrity: the levels (L1-L3+) impose increasingly strict requirements — from "there is provenance" (a signed statement of how the artifact was built), via "the build system is hardened and the provenance can't be forged", to fully isolated, verifiable builds. Win: you can prove and verify that a binary comes from a certain commit, built by a trusted system, without intermediaries that could have tampered with it. It complements SBOM (WHAT is included) with provenance (HOW it was built). Tools like Sigstore are used to sign and verify. A central part of modern supply-chain security. Related to SBOM and Sigstore/cosign.