This is a quick-start guide for infrastructure providers such as build platforms or package registries that want to support SLSA for their users. The work involved in supporting SLSA differs depending on the sort of infrastructure or tooling you provide.

Types of infrastructure

Build platform

  1. Verify that your infrastructure is suitable to produce SLSA provenance. To learn more about verifying your system for SLSA conformance, see Verifying build platforms.
  2. Add support for generating SLSA provenance. To learn more about producing provenance, see Producing artifacts. To learn more about the SLSA provenance format, see Provenance.

Package registry

  1. Verify provenance for the software you distribute. To learn more about verifying provenance, see Verifying artifacts.
  2. Distribute provenance for the software you distribute. To learn more about distributing provenance, see Distributing provenance.

Compiler or other CLI build tool

  1. Do nothing. While your tool can produce SLSA provenance, it will never be able to reach Build levels beyond Build Level 1. Instead, encourage your users to produce SLSA provenance in their build platform.