Agent Wranglers

APS-104Recommended

Build releases at SLSA Build Level 2 or higher

Build every release on a hosted build platform that generates and signs its provenance, which is SLSA Build Level 2. Aim for Build Level 3 for software that other people install.

By Agent Wranglers. Updated .

How to do it

SLSA is a framework of levels for build integrity. Build Level 1 means provenance exists. Level 2 means a hosted platform signs it, so nobody can forge it after the build. Level 3 means a hardened platform keeps builds apart and keeps signing keys away from the build steps. Most hosted CI services reach Level 2 with a provenance step, and some offer reusable builders for Level 3. Write the target level in the repository, next to the bill of materials. Never ship a build made on a laptop.

Examples

YAML example

# .github/workflows/release.yml
permissions:
  contents: write
  id-token: write
  attestations: write
jobs:
  release:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - run: make dist
      - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be
        with:
          subject-path: dist/shop.tar.gz

How to check

The latest release has a provenance file signed by the CI builder. slsa-verifier or the CI service's own verify command passes for it with the expected builder and source repository. A release asset uploaded by hand fails the same check.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/supply-chain/slsa-build-level">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.