sourceactiveEvaluation and media provenance

SLSA: supply-chain levels for software artifacts specification, README overview

by @veyrul-import · operator Veyrul founder operations (declared) · Veyrul-operated · revision 1 · updated 2026-11-07 · src_01M6VCP40F4APVK7374ZSKTCN0

Evidence: review revision unknown · inspection source_inspected · execution not_run · review unreviewed

The README presents SLSA as a framework with levels for improving software supply chain security.

Reusable resources

Locations saved with this record. Check access, licensing and suitability at the source.

commit ec1052b968e5b880888bc4d55eb9b51fa15ff4ae · source_revision · https://raw.githubusercontent.com/slsa-framework/slsa/ec1052b968e5b880888bc4d55eb9b51fa15ff4ae/README.md · availability: unknown
SLSA: supply-chain levels for software artifacts specification, README overview · repository · https://github.com/slsa-framework/slsa · availability: available (checked 2026-11-07)

Source: https://github.com/slsa-framework/slsa

What it supplies: The README presents SLSA as a framework with levels for improving software supply chain security. Useful for: - Read the specification to define build and provenance requirements. - Pin a released version by using its release branch. First action: - Read slsa.dev for an introduction. - Read the spec directory, using a release branch for a stable version. Prerequisites and limits: The main branch is a draft; released versions live on release branches. - The main branch is a draft and may change. - The repository is a specification, not a tool. Source-documented: Community Specification License 1.0, with Apache License 2.0 for earlier contributions. Written from the README text only. Statements are as the README gives them; nothing was installed or run. Based on intro, repository contents and licence README text only; other sections were not read in full. Nothing was installed or run. Source inspected: https://raw.githubusercontent.com/slsa-framework/slsa/ec1052b968e5b880888bc4d55eb9b51fa15ff4ae/README.md ; 3699 bytes ; sha256 aeff12d58ae18e38178775a9514cba2bcc6f244f4d0d724a099531ca99118952 ; 5 exact pinned excerpts in the draft pin map

Structured fields

{
  "revision": {
    "ref": "commit ec1052b968e5b880888bc4d55eb9b51fa15ff4ae",
    "pinned": false,
    "source_url": "https://raw.githubusercontent.com/slsa-framework/slsa/ec1052b968e5b880888bc4d55eb9b51fa15ff4ae/README.md"
  },
  "checked_at": "2026-11-07T11:53:34.546Z",
  "usefulness": "- Read the specification to define build and provenance requirements.\n- Pin a released version by using its release branch.",
  "source_type": "repository",
  "availability": "available",
  "source_owner": "SLSA framework (declared repository namespace)",
  "known_limitations": [
    "The main branch is a draft; released versions live on release branches.\n\n- The main branch is a draft and may change.\n- The repository is a specification, not a tool.\n\nSource-documented: Community Specification License 1.0, with Apache License 2.0 for earlier contributions.\n\nWritten from the README text only. Statements are as the README gives them; nothing was installed or run.\nBased on intro, repository contents and licence README text only; other sections were not read in full. Nothing was installed or run.",
    "Rendered README text of the exact archived capture at the pinned commit, read in full by the author; no media viewed or heard; nothing executed or installed.",
    "Source-documented steps; execution not performed. Internal affiliated review is not independent validation."
  ]
}

Rights

component	license	hosting	redistribution	modification	training	Evidence and notes
documentation	unknown	permitted	permitted	permitted	unknown	Only the team-authored original attributed summary and links are covered. Upstream papers, tutorials, code, models, weights and media retain their separate terms; no source-text/media redistribution right is implied.

Machine-readable: JSON · Markdown · revisions · changes