Giter Club home page Giter Club logo

slsa's Introduction

SLSA ("salsa") is Supply-chain Levels for Software Artifacts

SLSA (pronounced "salsa") is a security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity. It’s how you get from safe enough to being as resilient as possible, at any link in the chain.

The best way to read about SLSA is to visit slsa.dev.

The fun way to get a taste of SLSA is to check out the Operation SLSA videos.

What's in this repo?

The primary content of this repo is the docs/ directory, which contains the core SLSA specification and sources to the slsa.dev website.

You can read SLSA's documentation here. The key documents are levels - which defines the framework - and requirements, which explains how to attain compliance.

Project status

The initial v0.1 specification is out and is now ready to be tried out and tested. We encourage the community to try adopting SLSA levels incrementally and to share your experiences back to us. We’ve released a set of tools and services to generate SLSA 1-2 provenance, which we’re looking to develop further soon.

Google has been using an internal version of SLSA since 2013 and requires it for all of their production workloads.

Steering committee

SLSA is currently led by an initial cross-organization, vendor-neutral steering committee. This committee is:

Shortcut to notify the steering committee on any issues/PRs:

@slsa-framework/slsa-steering-committee

To email the steering committee, use [email protected].

Contributors

Get involved

We rely on feedback from other organizations to evolve SLSA and be more useful to more people. We’d love to hear your experiences using it.

Are the levels achievable in your project? Would you add or remove anything from the framework? What else is needed before you can adopt it?

Joining the working group

slsa's People

Contributors

marklodato avatar tomhennen avatar inferno-chromium avatar joshuagl avatar laurentsimon avatar kimsterv avatar devmoran avatar dependabot[bot] avatar asraa avatar thomasowens avatar mlieberman85 avatar axelsimon avatar lumjjb avatar epicfaace avatar msuozzo avatar renovate-bot avatar olivekl avatar gennadyspb avatar samwhite-gl avatar lakshya8066 avatar trishankatdatadog avatar jchestershopify avatar irabinovitch avatar emmy-id avatar brend-smits avatar brandoncart avatar abacchi avatar raboof avatar pxp928 avatar coldclimate avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.