State the SLSA Build level you can prove, not the one you want. Build L1 means your build produces provenance, L2 means a hosted platform signs it, and L3 means a hardened platform protects the signing secrets. If you have none yet, say so, and describe the first step you will take.
What the levels mean
SLSA (Supply-chain Levels for Software Artifacts) defines a Build track. The specification describes provenance as a record of what entity built the artifact, what process it used, and what the inputs were. The levels, in the specification's words in summary:
| Level | Name | What it adds |
|---|---|---|
| Build L1 | Provenance exists | Provenance is generated. Helps avoid mistakes but is easy to bypass or forge |
| Build L2 | Hosted build platform | A hosted platform generates and signs provenance, and consumers validate it. Protects against tampering after the build |
| Build L3 | Hardened builds | Runs cannot influence each other, and signing secrets are kept away from user defined build steps. Protects against tampering during the build |
The same specification says the main purpose of the track is to let consumers verify that an artifact was built as expected, by comparing actual provenance with what they expect.
Why provenance without verification is weak
Generating provenance is half the job. If nobody checks it, a forged document passes as easily as a real one. When you answer a buyer, say who verifies the provenance. If the answer is "nobody yet", say that. It is still a fair starting point.
How to answer, by situation
You build on a hosted CI service and publish provenance. You may be at L2, but confirm the platform really signs the provenance and that your consumers can validate it. Check the current specification for exact requirements.
You build in CI but generate no provenance. Say: "Builds run in hosted CI from tagged commits. We do not yet publish signed provenance. We plan to start with generation, and will state our level when we have verified it."
You build on laptops. Say so, and describe your plan to move releases into CI. This is a common early stage state, and a plain answer keeps trust.
Avoid "SLSA compliant" or "SLSA certified". SLSA defines levels. It is not a certification you hold.
Steps to move from nothing to L1 or L2
- Run release builds only from CI, never from a laptop.
- Require review on the branch that releases come from.
- Turn on provenance generation in your build platform if it offers it.
- Store provenance next to the artifact.
- Decide who verifies it, and write down the check.
- Review the current spec before you claim a level, since the specification gets revised.
Note that the version 1.1 levels page is marked retired, with version 1.2 current. The level names matched in the 1.2 build track page, but always cite the version you checked.
Quick check
Is SLSA a certification?
No. SLSA is a specification with levels. Describe your build level, not a certification.
Does generating provenance make us L2?
Not by itself. L2 needs a hosted platform that generates and signs provenance, and consumers who validate it.
Try it yourself
Click through it at your own pace, or open it full screen. It shows the inventory of what went into a build, the companion to provenance's record of how it was built.
Safeguard generates SBOMs and scans dependencies, so you can answer the "what is in it" half of the question. The free scan is a way to see that for one repository.
Sources
- SLSA, Build track levels, version 1.1 (retired page) and version 1.2 build track basics. Paraphrased.
Last reviewed: 19 October 2026.
