Zennoxa Shield
Application Security Glossary

SLSA (Supply-chain Levels for Software Artifacts)

SLSA (Supply-chain Levels for Software Artifacts) is an open security framework that defines a graded set of levels for hardening the software build and release process, using verifiable provenance to protect artifacts from tampering between source and consumer.

SLSA, pronounced "salsa" and short for Supply-chain Levels for Software Artifacts, is a vendor-neutral framework governed under the Open Source Security Foundation. It describes a series of increasing maturity levels that progressively harden how software is built, so consumers can trust that an artifact was produced from the expected source through the expected process without unauthorized modification.

The framework centers on build integrity and provenance: at higher levels, builds run on a hardened, isolated build platform that generates signed, tamper-evident provenance describing exactly which sources and steps produced each artifact. This lets a consumer verify the artifact's origin and reject anything that does not match the expected build.

For developers and organizations, SLSA provides a concrete, incremental roadmap for defending against supply chain attacks such as compromised build servers, dependency substitution, and tampered releases. Because it is expressed as measurable levels, teams can adopt it step by step and communicate their build security posture in a standardized way.

Frequently asked questions

What is SLSA?
SLSA is an open framework of graduated security levels for the software build and release pipeline, using verifiable provenance to ensure artifacts are produced from expected sources and cannot be tampered with in transit.
How do SLSA levels work?
SLSA defines increasing levels that add stronger requirements, from generating provenance to running builds on a hardened, isolated platform that produces signed, tamper-resistant provenance a consumer can verify.
SLSA vs build provenance?
Build provenance is the signed metadata describing how an artifact was built; SLSA is the broader framework that specifies how provenance must be generated, protected, and verified across defined maturity levels.

Related terms

SLSA (Supply-chain Levels for Software Artifacts) — Zennoxa Glossary — Zennoxa Shield