International · technical specification

SLSA v1.0: what it asks, and the records to keep

SLSA, an OpenSSF specification, defines levels of assurance that a software artifact was built as claimed, centered on signed build provenance. v1.0 (April 2023) introduced the Build track; it is now marked retired, replaced by v1.1 (April 2025) and v1.2 (November 2025), which added a Source track and remain backward compatible.

Start free Open the Console

Legal forceVoluntary framework

StatusSuperseded

Applies from19 Apr 2023

JurisdictionInternational

Checked21 Oct 2026

01 / What it asks

What SLSA v1.0 asks

Software producers and build platform operators that want to show build integrity, and consumers verifying artifacts.

01Build L1: follow a consistent build process and generate and distribute provenance describing platform, process and top-level inputs.
02Build L2: run builds on a hosted build platform that signs the provenance.
03Build L3: use a hardened platform that isolates runs and keeps signing secrets from user-defined build steps.
04Consumers verify provenance against expected builder, source and parameters before use.

02 / AI work

Where it touches AI work

Build provenance can apply to model training or packaging pipelines that produce AI artifacts, but SLSA does not address models or data specifically.

03 / Dates

The dates that matter

19 Apr 2023

SLSA v1.0 released, first stable version

April 2025

v1.1 released, replacing v1.0, backward compatible

24 Nov 2025

v1.2 released, adding the Source track

04 / Enforcement

Who enforces it

None; voluntary.

05 / Records

Records an organisation keeps

What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.

01Signed SLSA provenance attestations per artifact
02Build platform SLSA level documentation
03Verification summary attestations (VSAs) or verifier logs

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES