SLSA build levels give buyers a shared way to ask whether a target's releases were built the way it says. Level 1 records provenance, level 2 uses a hosted platform that signs it, and level 3 adds a hardened build platform. Claim a level only if you can show it.
What the levels mean
According to the SLSA specification, the Build track runs as follows:
- L0: no requirements, typical of builds on a single developer machine.
- L1: the package ships with provenance describing how it was built. This catches mistakes but is easy to bypass or forge.
- L2: builds run on a hosted platform that generates and signs provenance, which makes tampering after the build harder.
- L3: builds run on a hardened platform with strong protection against tampering during the build.
Why a buyer cares
An acquirer is buying software it will keep shipping. If the target builds on a laptop with manual steps, one person effectively controls what customers receive. A buyer wants to know whether a release can be traced to a specific commit, built in a controlled place.
What to ask
- Where are releases built, and by whom?
- Is the build scripted and reproducible from source?
- Is there provenance or signing for artifacts?
- Who can change the build configuration?
- How are build secrets stored?
What sellers can do cheaply
- Move releases to a hosted CI system.
- Pin build tooling and dependencies.
- Restrict who can edit pipeline files and require review.
- Sign artifacts and keep the records.
These steps move you toward L2 without large cost. Do not state an SLSA level unless the evidence supports it, because buyers will check.
Reading the answers
Listen for specifics. A team that builds on a hosted CI system, restricts who can edit pipeline files and signs artifacts can usually describe each step quickly. A team that says builds are automated but cannot say where, who can change them or how artifacts are checked probably sits near L0 or L1.
Also ask for one recent release and trace it. Pick a version in production, then ask for the commit, the build run, the artifact record and the deployment event. Doing this live takes ten minutes and tells you more than a questionnaire.
If the trace fails, treat it as an integration item, not necessarily a deal issue. Hardening a pipeline is well understood work, and it often fits in the first 100 days after close.
Quick check
Is SLSA a certification?
No. It is a framework of levels. Describe what you do and map it to the level honestly.
Sources
Last reviewed: 19 October 2026.
