SLSA Framework

The foundational tier requires that the build process generates a provenance attestation—a verifiable statement describing how the artifact was built, including source repository, build command, and entry point. This data must be made available to consumers for manual inspection. However, the build itself is not required to be hermetic or isolated, meaning the provenance is informational rather than tamper-proof. Level 1 establishes the cultural and tooling baseline for generating signed metadata without enforcing strict security controls on the build environment.

This level mandates the use of a dedicated, hosted build service (e.g., GitHub Actions, Google Cloud Build) rather than a developer's local workstation. The build platform must generate and sign provenance automatically. Key requirements include:

• Source integrity: The build service must fetch source from a defined, version-controlled location.
• Signed provenance: The platform cryptographically signs the attestation, linking it to the build service's identity. This prevents a malicious insider from manually crafting a fake provenance record on their laptop, as all builds must flow through a controlled, observable channel.

Level 3 introduces stringent controls to prevent the build process itself from being subverted. The build must run in an isolated, ephemeral, and hermetic environment with no network access to prevent exfiltration or injection of untrusted dependencies. Specific controls include:

• Non-falsifiable provenance: Consumers can cryptographically verify the provenance was generated by a trusted platform and has not been tampered with.
• Hermeticity: All build inputs, including transitive dependencies, must be declared and fetched from a trusted, immutable source before isolation begins.
• Reproducibility: While not strictly required, the build configuration must be fully captured to enable auditing and eventual reproduction. This level provides strong resistance against compromised build tools or dependency confusion attacks.

The highest assurance tier requires hermetic, fully reproducible builds and two-person review of all source code and build configurations. A Level 4 artifact can be independently rebuilt bit-for-bit from source, providing cryptographic proof that no tampering occurred during compilation. Requirements include:

• Reproducible builds: Independent rebuilds produce a byte-for-byte identical artifact.
• Two-person review: All changes to source and build recipes must be approved by a second authorized party.
• Asymmetric isolation: The build process has no network access, and the provenance signing key is stored in a hardware security module (HSM). This level defends against sophisticated supply-chain attacks where the build platform itself might be compromised by a persistent adversary.

A cryptographic data structure using a tree of hashes that allows efficient and secure verification of the integrity and membership of a specific data block within a large, immutable dataset or log. Underpins the transparency logs used in SLSA-compliant provenance systems.

• Efficiency: Verifying a single record requires only O(log n) hash comparisons, not the entire dataset
• Tamper Evidence: Any change to a leaf node cascades upward, invalidating the root hash
• Application: Powers Rekor's transparency log and Certificate Transparency for build artifact verification

A cryptographic mechanism using asymmetric key pairs to validate the authenticity and integrity of a digital message or document, providing non-repudiation of the signer's identity. SLSA mandates digital signatures on provenance attestations to prevent forgery.

• Algorithm: Ed25519, ECDSA, or RSA with secure key lengths
• SLSA Requirement: Build platforms must sign provenance with a private key accessible only to the build service
• Non-Repudiation: A valid signature cryptographically proves the build platform—not an attacker—generated the attestation

A chronologically ordered, write-once-read-many log of all events and transactions related to a data asset, cryptographically secured to prevent retroactive alteration. SLSA's highest assurance level (L3) requires an immutable audit trail for all build and provenance generation steps.

• Implementation: Append-only ledgers, transparency logs, or blockchain anchoring
• SLSA L3 Requirement: Build process must be fully auditable with no mutable intermediate states
• Verification: Auditors can replay the log to reconstruct exactly what happened during a build, even years later