We rely on feedback from other organizations to evolve SLSA and be more useful to more people. We’d love to hear your experiences using it, and welcome all contributions, challenges and collaboration.
“SLSA’s really the first of its kind, a framework for supply chain and build integrity. What sets it apart is the thriving community behind it, and it’s resonating with different organizations.”
The initial v0.1 specification is out and is now ready to be tried out and tested.
We’ve released an initial set of tools and services to generate SLSA 1-2 provenance, which we’re looking to develop further soon.
Google has been using an internal version of SLSA since 2013 and requires it for all of their production workloads.