# Supply Chain Levels Slsa

> Use when implementing SLSA supply chain levels.

- Skill: `loopyluci/supply-chain-levels-slsa` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/supply-chain-levels-slsa`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/supply-chain-levels-slsa/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/supply-chain-levels-slsa

---


# SLSA Supply Chain Levels

Implementing SLSA (Supply-chain Levels for Software Artifacts) — from build integrity through provenance attestation, hermetic builds, and reproducible builds.

## When to Use

- Improving software supply chain security
- Meeting SLSA compliance requirements
- Ensuring build integrity and provenance
- Preventing supply chain attacks
- Building trustworthy CI/CD pipelines

## SLSA Levels

```python
SLSA_LEVELS = {
    1: 'Build script — automated builds, provenance exists (provenance shows source + build)',
    2: 'Version control + hosted build — source in VCS, build service runs build script',
    3: 'Hardened build — no user-defined build steps, hermetic, reproducible, dependencies verified',
    4: 'Two-party review — all changes reviewed, build independently verifiable, cryptographic signing',
}

class SLSACompliance:
    """Check SLSA level compliance of build pipeline."""
    
    def __init__(self):
        self.requirements = {
            1: ['Automated builds', 'Provenance generated'],
            2: ['Source in version control', 'Hosted build service', 'Provenance authenticated'],
            3: ['Hermetic builds', 'Reproducible builds', 'Dependencies verified', 'Build as code'],
            4: ['Two-party review', 'Build independent verification', 'Provenance signed by two parties'],
        }
    
    def check_level(self, current_fulfillments: List[str], target: int = 2) -> Dict:
        met = []
        unmet = []
        for req in self.requirements.get(target, []):
            if req in current_fulfillments: met.append(req)
            else: unmet.append(req)
        return {'level': target, 'met': len(met), 'total': len(met) + len(unmet), 'gaps': unmet}
```

## Verification Checklist

- [ ] Current SLSA level assessed
- [ ] Build provenance generated (in-toto attestation)
- [ ] Build service hosted (not developer machine)
- [ ] Build script defined as code (Dockerfile, CI config)
- [ ] Hermetic builds (no network access during build)
- [ ] Build artifacts signed (cosign or similar)
- [ ] Dependencies verified (checksums, SLSA-verified)
- [ ] Two-party review for code changes