Supply Chain Levels for Software Artifacts (SLSA) is a security framework that helps ensure the integrity of software artifacts. It aims to prevent cyberattacks by providing a model for security capabilities in the supply chain. The OpenSSF launched SLSA (pronounced salsa) in 2021, which grew to around 30 contributors within a year.
SLSA is inspired by Google’s established process for production workloads. SLSA helps address questions about trust—it helps you determine if the code you’re using is free of tampering and evaluate if the source code or build system used to create software packages is trustworthy.
What differentiates SLSA from other security guidelines is its design based on automatically creating verifiable metadata rather than simply providing a list of best practices. This metadata is useful for making policy decisions. SLSA goes beyond describing the process required to secure the software supply chain—it helps you implement security in the real world and obtain the data to demonstrate it.