Tool

SLSA

Supply-chain Levels for Software Artifacts—provenance requirements that show how an artefact was built.

slsa.dev

Where it helps

• Govern the Factory and the Product Separately

  Provenance describes the factory that produced an artefact, separate from runtime product posture.

• Evidence by Default

  Build provenance is emitted as normal exhaust of trusted builds.

• Governance is Version Controlled

  Provenance documents are verifiable, portable artefacts with immutable history.