SLSA build levels — L0 through L3 and what each level guarantees

SLSA build levels describe incremental guarantees about the build process. L0 has no provenance; L1 has provenance but does not sign it; L2 adds signed provenance and an isolated build platform; L3 adds a hardened build platform and two-party review. The levels are the yardstick the audit team uses to score the supply chain; the yardstick the platform team uses to plan remediation. The question is not “what level should we operate at?” but “what level can we operate at given the platform we have?”.

The four levels

• L0 — No guarantees. The build is not documented. There is no provenance; the consumer cannot answer “where did this artifact come from?”.
• L1 — Provenance exists. The build produces a provenance attestation that names the source, the builder, and the step. The provenance is not signed; the consumer can read the claim but cannot trust the signer.
• L2 — Provenance is signed and the build is isolated. The provenance is signed by the build platform; the build runs on a platform that prevents the script from accessing the signing key or the registry credentials during the build.
• L3 — Hardened build, two-party review. The build platform is hardened against runtime tampering; the build script cannot influence the provenance generation; a second party reviews the source before the build runs. L3 is the level designed to resist a determined attacker with access to the build pipeline.

flowchart LR
    A["L0: no provenance"] --> B["L1: provenance exists"]
    B --> C["L2: signed + isolated"]
    C --> D["L3: hardened + two-party"]
    A -.-> A1["Audit cannot answer"]
    B -.-> B1["Audit can read but not trust"]
    C -.-> C1["Audit can verify signer"]
    D -.-> D1["Audit can defend against insider"]

What each level prevents

The threats the levels mitigate are not the same:

• L1 prevents the silent absence of provenance. The audit team can ask “where did this artifact come from?” and get an answer, even if the answer is unsigned.
• L2 prevents a forger from producing a fake provenance. The signature binds the attestation to the build platform’s identity.
• L3 prevents an attacker who has compromised the build script from tampering with the provenance. The provenance is generated by the hardened platform, not by the script.

L1 does NOT prevent forgery. L2 does NOT prevent a script-level compromise. L3 is the only level designed to resist a determined attacker with script-level access.

Mapping GitHub Actions to the SLSA levels

• L1: actions/attest-build-provenance@v1 produces a SLSA build provenance attestation. The attestation is unsigned at this level.
• L2: GitHub signs the attestation with the OIDC identity of the workflow. The verifier pins the workflow path and the issuer URL; the build runs on GitHub-hosted runners that isolate the build script from the signing material.
• L3: The build runs on hardened runners, the workflow file is reviewed by a code owner before merge, and the source branch is protected with two-party review.

The progression is the same shape as the audit benchmark: more control, more review, more cost.

The production cost of operating at L3

L3 is not free. The costs are build latency (hardened runners are slower), review friction (two-party review on every protected branch means every change waits for a second reviewer), and platform investment (L3 requires a build platform the team can demonstrate meets the hardened-build requirements). The production trade-off is between supply-chain integrity and developer velocity; the team’s risk appetite is the dial.

Production discipline

1. Generate provenance at L1. The audit team will ask for provenance; the build pipeline must produce it.
2. Sign the provenance at L2. Unsigned provenance is provenance that can be forged.
3. Document the level your platform achieves. The level is the answer to the audit question; the platform is the evidence.
4. Plan the L3 remediation as a roadmap. The level is the target; the roadmap is the path.

Cross-course references

• Git, CI/CD & GitOps — Part LXX-01 (What Provenance Is) is the concept; LXX-02 is the SLSA grading.
• Git, CI/CD & GitOps — Part LXIX-03 (Keyless Signing with Fulcio) is the signing infrastructure L2 requires.
• Container Security for Production Sysadmins — Part VII (Admission Control) is the verifier side.

Quiz