SLSA (Supply-chain Levels for Software Artifacts)
SLSA (Supply-chain Levels for Software Artifacts) is an open security framework that defines a graded set of levels for hardening the software build and release process, using verifiable provenance to protect artifacts from tampering between source and consumer.
SLSA, pronounced "salsa" and short for Supply-chain Levels for Software Artifacts, is a vendor-neutral framework governed under the Open Source Security Foundation. It describes a series of increasing maturity levels that progressively harden how software is built, so consumers can trust that an artifact was produced from the expected source through the expected process without unauthorized modification.
The framework centers on build integrity and provenance: at higher levels, builds run on a hardened, isolated build platform that generates signed, tamper-evident provenance describing exactly which sources and steps produced each artifact. This lets a consumer verify the artifact's origin and reject anything that does not match the expected build.
For developers and organizations, SLSA provides a concrete, incremental roadmap for defending against supply chain attacks such as compromised build servers, dependency substitution, and tampered releases. Because it is expressed as measurable levels, teams can adopt it step by step and communicate their build security posture in a standardized way.