Today we’re releasing for public review SLSA Version 1.2 RC1, a Release Candidate of SLSA v1.2. We are seeking comments on this specification by July 18th, 2025.
With the introduction of the Source Track, SLSA v1.2 represents a major milestone in the development of SLSA. Indeed, while SLSA v1.0 introduced the notion of tracks with different levels focusing on different aspects of the software supply chain, its scope was limited to the Build Track, a narrower scope than what SLSA v0.1 covered. The Source Track picks up the source management related requirements that v0.1 touched on but in a much more complete and thorough way, comparable to what was done in the Build Track.
Please, refer to the What’s new section for further details.
SLSA v1.2 is backwards compatible with SLSA v1.1.
The SLSA specification follows the Community Specification lifecycle going through several stages of maturation. The publication of a candidate for Approved Specification starts a 2 week review period during which the community at large is invited to review the draft and raise any issues. If you do find any issue, please, open an issue on GitHub. If no major issues are found during this review period the v1.2 RC1 draft will then be published as Version 1.2, the new Approved Specification, effectively replacing Version 1.1. Otherwise a v1.2 RC2 will be published instead.