Use cases

Here’s what SLSA looks like in practice, typical cases to explore and break down how compliance can provide protection. Whether you’re a developer working on a project or part of an enterprise, SLSA can be helpful both for securing your supply chain and clarifying existing tools and processes. The case studies expand even further, and are a work in progress as SLSA gets adopted in the industry.

ON THIS PAGE

Example use cases
Case studies

Example use cases

Developers

To inventory all the source and build systems (Level 1)
Decoupling development toolchains (e.g. untrusted IDE extensions) and workflows from the artifacts you publish (Level 2)
Providing a public audit trail of source and builds to demonstrate a commitment to securing a supply chain (Level 3)
Eliminating unilateral access to produce releases so that compromise of your machine or credentials alone won’t be enough to backdoor your package (Level 4)

Enterprises

Accounting for all build processes and systems used (Level 1)
Ensuring that release artifacts are built through a common, publicly accessible workflow to facilitate onboarding new maintainers and providing transparency to your users (Level 2)
Stratifying applications by their security sensitivity and ensuring low-assurance projects can’t adversely impact higher-assurance ones (Level 3)
Preventing the compromise of a single employee leading to compromise all your users (Level 4)

Platforms

Recording the steps necessary to build a release (Level 1)
Establishing a cryptographic chain of custody between trusted builds and your release and code-signing workflows (Level 2)

Case studies

These case studies go much more in depth. Starting from a particular scenario, they look at how you might harden an entire system over time, starting with immediate problems to solve and following through next steps to incrementally progress through to the higher SLSA levels, with space for the development of automatic analysis and policies.

Example case studies

Real world examples

If you’ve been using SLSA already, get in touch.

The scenarios above are proof of concepts and theoretical explorations. As more people adopt SLSA, we’ll add case studies to walk you through what long term adoption of the SLSA framework could look like, with real world scenarios, application and discovery, planning and strategic development.

The contribution guidelines help guide your feedback, and every contribution is useful for others to see how SLSA can be used in their project or organization.

Submit a case study