SLSA (Supply-chain Levels for Software Artifacts)

SLSA (Supply-chain Levels for Software Artifacts, said "salsa") is a security framework that sets levels for how far you can trust the way a software artifact was built. Its core idea is build provenance: a record of how an artifact was produced that consumers can check.

What it is

The SLSA Build track has four levels:

• Build L0: no guarantees.
• Build L1: provenance exists. It shows how the package was built, but it may be incomplete or unsigned.
• Build L2: builds run on a hosted build platform that signs the provenance.
• Build L3: builds run on a hardened platform, and the secret used to sign the provenance is kept away from the build steps.

Each level protects against a stronger attacker. L1 catches mistakes; L3 resists tampering during the build itself.

Why it matters

Reviewing source only protects you if the artifact you run was built from that source. Provenance lets a consumer check which builder made an artifact and from what inputs, so a package built somewhere else, or from different code, can be refused.

In AI CodeOps

AI CodeOps doesn't build artifacts or generate SLSA provenance. That stays with your CI. What it records is how a change was made before the build: its sessions, approvals, policy decisions, findings and test results, signed with Ed25519 in an evidence pack. See provenance for how the two records fit together.