What Is SLSA (Supply-chain Levels for Software Artifacts)?
A security framework by Google that defines increasing levels of supply chain integrity guarantees (L0-L4).
Definition
A security framework by Google that defines increasing levels of supply chain integrity guarantees (L0-L4).
SLSA ensures that software artifacts have not been tampered with during the build and distribution process. CDEs can enforce SLSA compliance by controlling build environments.
Where This Fits
This term is covered in depth on Code Provenance.
Most agents commit under a human identity, which breaks attribution and audit. Signing, trailers, service accounts and provenance for generated code.