SLSA Compliance

This document describes Stella Ops’ compliance with the Supply-chain Levels for Software Artifacts (SLSA) framework.

Current SLSA Level

Stella Ops releases target SLSA Level 2 with ongoing work toward Level 3.

SLSA v1.0 Provenance

Predicate Type

Stella Ops uses the standard SLSA v1.0 provenance predicate:

https://slsa.dev/provenance/v1

Provenance Structure

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "stella-1.2.3-linux-x64.tar.gz",
      "digest": {
        "sha256": "abc123..."
      }
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v1",
  "predicate": {
    "buildDefinition": {
      "buildType": "https://stella-ops.io/ReleaseBuilder/v1",
      "externalParameters": {
        "version": "1.2.3",
        "target": "linux-x64"
      },
      "resolvedDependencies": [
        {
          "uri": "git+https://git.stella-ops.org/stella-ops.org/git.stella-ops.org@v1.2.3",
          "digest": {
            "gitCommit": "abc123..."
          }
        }
      ]
    },
    "runDetails": {
      "builder": {
        "id": "https://ci.stella-ops.org/builder/v1"
      },
      "metadata": {
        "invocationId": "12345/1",
        "startedOn": "2025-01-15T10:30:00Z",
        "finishedOn": "2025-01-15T10:45:00Z"
      }
    }
  }
}

Verification

Verifying Provenance Signature

cosign verify-blob \
  --key cosign.pub \
  --signature provenance/stella-cli.slsa.intoto.jsonl.sig \
  provenance/stella-cli.slsa.intoto.jsonl

Inspecting Provenance

# View full provenance
cat provenance/stella-cli.slsa.intoto.jsonl | jq .

# Extract builder ID
cat provenance/stella-cli.slsa.intoto.jsonl | jq -r '.predicate.runDetails.builder.id'

# Extract source commit
cat provenance/stella-cli.slsa.intoto.jsonl | jq -r '.predicate.buildDefinition.resolvedDependencies[0].digest.gitCommit'

Policy Verification

Verify provenance matches your policy:

# Example: Verify builder ID
BUILDER_ID=$(cat provenance/stella-cli.slsa.intoto.jsonl | jq -r '.predicate.runDetails.builder.id')
if [ "$BUILDER_ID" != "https://ci.stella-ops.org/builder/v1" ]; then
  echo "ERROR: Unknown builder"
  exit 1
fi

Strict Validation Mode

Stella Ops supports strict SLSA validation that enforces:

1. Valid builder ID URI - Must be a valid absolute URI
2. Approved digest algorithms - sha256, sha384, sha512, sha3-*
3. RFC 3339 timestamps - All timestamps must be properly formatted
4. Minimum SLSA level - Configurable minimum level requirement

Configuration

In appsettings.json:

{
  "Attestor": {
    "Slsa": {
      "ValidationMode": "Strict",
      "MinimumSlsaLevel": 2,
      "AllowedBuilderIds": [
        "https://ci.stella-ops.org/builder/v1",
        "https://github.com/actions/runner"
      ]
    }
  }
}

SLSA Requirements Mapping

Source Requirements

Build Requirements

Provenance Requirements

Verification Tools

Using slsa-verifier

# Install slsa-verifier
go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@latest

# Verify artifact
slsa-verifier verify-artifact \
  artifacts/stella-1.2.3-linux-x64.tar.gz \
  --provenance-path provenance/stella-cli.slsa.intoto.jsonl \
  --source-uri github.com/stella-ops/stella-ops \
  --builder-id https://ci.stella-ops.org/builder/v1

Using Stella CLI

stella attest verify \
  --artifact artifacts/stella-1.2.3-linux-x64.tar.gz \
  --provenance provenance/stella-cli.slsa.intoto.jsonl \
  --slsa-level 2 \
  --builder-id https://ci.stella-ops.org/builder/v1

Roadmap to SLSA Level 3

Current gaps and planned improvements:

Related Documentation

• Release Evidence Pack
• Reproducible Builds
• Attestor Architecture