SLSA — Software Supply Chain Security

SLSA defines 3 levels of supply chain integrity. Level 1: provenance. Level 2: hosted build + signed provenance. Level 3: hardened build + non-falsifiable provenance. Sigstore (Cosign, Rekor, Fulcio) implements keyless signing.

Overview

Proving where an artifact came from

SLSA (Supply-chain Levels for Software Artifacts, pronounced "salsa") is a security framework from Google, now at OpenSSF, that defines graduated levels of software supply chain integrity. It was created in response to attacks like SolarWinds and Log4Shell, where the build pipeline or dependency chain was compromised.

The three levels of SLSA v1.0

L1: Provenance — The build generates an attestation describing how the artifact was built (source, builder, inputs); it need not be signed — Basic auditability
L2: Hosted build + signed provenance — The build runs on a trusted hosted platform (GitHub Actions, Google Cloud Build) and provenance is signed by that platform's identity — They can verify the build platform
L3: Hardened build + non-falsifiable provenance — The build environment is hardened (isolated, ephemeral, no network egress) and the platform generates provenance so even the build script cannot forge it — A compromised build step cannot lie about the artifact

> [!IMPORTANT] SLSA proves where an artifact came from; it says nothing about whether the source code itself is trustworthy.

Sigstore implements the signing

Cosign — Signs images and attestations
Rekor — Immutable transparency log
Fulcio — OIDC-based CA for keyless signing

Key concepts

Provenance Attestation: A signed, machine-readable document (in-toto attestation) describing how an artifact was built: source repo, commit hash, builder identity, build environment. Allows consumers to verify "this image was built by GitHub Actions from commit abc123 of repo org/myapp."
Cosign (Sigstore): CLI tool for signing and verifying container images and attestations. Supports keyless signing (OIDC-based ephemeral certificates from Sigstore PKI) and key-based signing. Adds signatures to the OCI registry alongside the image digest.
Rekor (Sigstore): Immutable, append-only transparency log for software signatures. Every Cosign signature is recorded in Rekor. Consumers query Rekor to verify a signature exists and was recorded at a specific time.
Keyless Signing: Sign without managing long-lived key pairs. CI job gets a short-lived certificate from Fulcio CA based on OIDC identity (GitHub Actions workload identity). The signature is tied to the workflow identity. No secrets to rotate; certificates expire in 10 minutes.

When to use it

Securing CI/CD pipelines against build-time tampering
Verifying deployed images were built by your CI system and not modified
NIST SSDF or Executive Order 14028 software supply chain compliance
Kubernetes admission control: only allow images with valid provenance

Interview questions

What problem does SLSA solve and what are its three levels?
How does keyless signing with Sigstore work?