diff --git a/docs/spec/v1.0/levels.md b/docs/spec/v1.0/levels.md index 3081fbdfa..6c4c6e898 100644 --- a/docs/spec/v1.0/levels.md +++ b/docs/spec/v1.0/levels.md @@ -28,11 +28,12 @@ Importantly, SLSA is intended to be a primitive in a broader determination of a software's risk. SLSA measures specific aspects of supply chain security, particularly those that can be fully automated; other aspects, such as developer trust and code quality, are out of scope. Furthermore, each link in the software -supply chain has its own, independent SLSA level ([FAQ](../faq.md)). The benefit -of this approach is to break up the large supply chain security problem into -tractable subproblems that can be prioritized based on risk and tackled in -parallel. But this does mean that SLSA alone is not sufficient to determine if -an artifact is "safe". +supply chain has its own, independent SLSA level---in other words, it is not +transitive ([FAQ](../faq.md#q-why-is-slsa-not-transitive)). The benefit of this +approach is to break up the large supply chain security problem into tractable +subproblems that can be prioritized based on risk and tackled in parallel. But +this does mean that SLSA alone is not sufficient to determine if an artifact is +"safe". > **TODO:** SLSA is in the eye of the beholder: software consumers make their > own SLSA determinations, though in practice they may delegate to some @@ -40,7 +41,7 @@ an artifact is "safe". ## Who is SLSA for? -There are three main audiences for SLSA: +SLSA is intended to serve multiple populations: - **Project maintainers,** who are often small teams that know their build process and trust their teammates. Their primary goal is protection against @@ -56,13 +57,18 @@ There are three main audiences for SLSA: addition to the goals above, organizations also want to broadly understand and reduce risk across the organization. +- **Infrastructure providers,** such as build services and packaging + ecosystems, who are critical to achieving SLSA. While not the primary + beneficiary of SLSA, they may benefit from increased security and user + trust. + ## Levels and tracks SLSA levels are split into *tracks*. Each track has own set of levels that measure a particular aspect of supply chain security. The purpose of tracks is to recognize progress made in one aspect of security without blocking on an unrelated aspect. Tracks also allow the SLSA spec to evolve: we can add more -tracks without invaliding previous levels. +tracks without invalidating previous levels. | Track/Level | Requirements | Benefits | | ----------- | ------------ | -------- | @@ -71,7 +77,7 @@ tracks without invaliding previous levels. | [Build L2] | Signed attestation, generated by a hosted build service | Reduced attack surface, weak tamper protection | | [Build L3] | Hardened build service | Strong tamper protection | | [Build L4] | (not yet defined) | | -| [Source] | (not yet defined) | | +| [Source L…] | (not yet defined) | | > Note: The [previous version] of the specification used a single unnamed track, > SLSA 1–4, roughly corresponding to the equivalently numbered Build + Source @@ -176,8 +182,8 @@ attack surface and increasing the difficulty to forge the provenance.