CINXE.COM

<!DOCTYPE html> <html lang="en"><head> <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta name="viewport" content="width=device-width, initial-scale=1" /> <meta name="generator" content="Jekyll v3.9.5" /> <meta property="og:title" content="Verification Summary Attestation (VSA)" /> <meta property="og:locale" content="en_US" /> <meta name="description" content="Specification for a verification summary of artifacts by a trusted verifier entity." /> <meta property="og:description" content="Specification for a verification summary of artifacts by a trusted verifier entity." /> <meta property="og:site_name" content="SLSA" /> <meta property="og:image" content="/images/icons/android-chrome-192x192.png" /> <meta property="og:type" content="website" /> <meta name="twitter:card" content="summary_large_image" /> <meta property="twitter:image" content="/images/icons/android-chrome-192x192.png" /> <meta property="twitter:title" content="Verification Summary Attestation (VSA)" /> <script type="application/ld+json"> {"@context":"https://schema.org","@type":"WebPage","description":"Specification for a verification summary of artifacts by a trusted verifier entity.","headline":"Verification Summary Attestation (VSA)","image":"/images/icons/android-chrome-192x192.png","publisher":{"@type":"Organization","logo":{"@type":"ImageObject","url":"/images/icons/android-chrome-512x512.png"}},"url":"/spec/v1.0/verification_summary"}</script>  <link rel="stylesheet" href="/vendor/tailwindcss-2.2.19/tailwind.min.css"> <link rel="stylesheet" href="/assets/main.css"> <link rel="apple-touch-icon" sizes="180x180" href="/images/icons/apple-touch-icon.png"> <link rel="icon" type="image/png" sizes="32x32" href="/images/icons/favicon-32x32.png"> <link rel="icon" type="image/png" sizes="16x16" href="/images/icons/favicon-16x16.png"> <link rel="icon" type="image/png" sizes="16x16" href="/images/icons/favicon-16x16.png"> <link rel="icon" type="image/x-icon" href="/images/icons/favicon.ico"> <link rel="mask-icon" href="/images/icons/safari-pinned-tab.svg" color="#5bbad5"> <meta name="msapplication-TileColor" content="#da532c" /> <meta name="msapplication-square150x150logo" content="/images/icons/mstile-150x150.png" /> <meta name="theme-color" content="#ffffff" /> <title>SLSA • Verification Summary Attestation (VSA)</title> <link rel="stylesheet" href="/fonts/inter/inter.css"> <link rel="stylesheet" href="/fonts/ibm_plex/IBMPlexMono-Regular.css"> <link rel="stylesheet" href="/fonts/prodigy/ProdigySans.css"> <script src="/vendor/swiper-6.8.4/swiper-bundle.min.js"></script> <link rel="stylesheet" href="/vendor/swiper-6.8.4/swiper-bundle.min.css"> <script defer src="/vendor/alpinejs-3.10.2/cdn.min.js"></script><link type="application/atom+xml" rel="alternate" href="/feed.xml" title="SLSA" /></head> <body x-data="{navOpen: false}" x-init="$refs.body.style.setProperty('--scrollbar-width', `${window.innerWidth - document.body.offsetWidth}px`)" x-ref="body" ><aside class="site-aside flex flex-col flex-none" :class="{'is-open': navOpen}" > <div class="aside-header p-5 flex justify-between items-center show-laptop"> <a rel="author" href="/" class="logo block"> <img class="logo-white" src="/images/logo.svg" alt="SLSA logo" /> </a> <a class="desktop-github-icon" href="https://github.com/slsa-framework/slsa" target="_blank"> <svg width="22" height="22" viewBox="0 0 22 22" fill="currentColor" xmlns="http://www.w3.org/2000/svg"> <path fill-rule="evenodd" clip-rule="evenodd" d="M11.2344 0.150879C5.28641 0.150879 0.468811 4.96848 0.468811 10.9165C0.468811 15.6803 3.55046 19.7039 7.82978 21.1303C8.36806 21.2245 8.56991 20.9016 8.56991 20.619C8.56991 20.3633 8.55646 19.5155 8.55646 18.6139C5.8516 19.1118 5.15184 17.9545 4.93653 17.3489C4.81541 17.0394 4.29059 16.084 3.83306 15.8283C3.45626 15.6264 2.91798 15.1285 3.8196 15.1151C4.66739 15.1016 5.27295 15.8956 5.47481 16.2185C6.44371 17.8468 7.99126 17.3893 8.61028 17.1067C8.70448 16.4069 8.98708 15.9359 9.29659 15.6668C6.90125 15.3977 4.39825 14.4691 4.39825 10.3513C4.39825 9.18051 4.81541 8.21161 5.50172 7.45802C5.39407 7.18888 5.01727 6.08541 5.60938 4.60514C5.60938 4.60514 6.51099 4.32254 8.56991 5.70861C9.43116 5.46639 10.3462 5.34527 11.2613 5.34527C12.1764 5.34527 13.0914 5.46639 13.9527 5.70861C16.0116 4.30909 16.9132 4.60514 16.9132 4.60514C17.5053 6.08541 17.1285 7.18888 17.0209 7.45802C17.7072 8.21161 18.1244 9.16706 18.1244 10.3513C18.1244 14.4826 15.6079 15.3977 13.2126 15.6668C13.6028 16.0032 13.9392 16.6492 13.9392 17.6584C13.9392 19.0983 13.9258 20.2556 13.9258 20.619C13.9258 20.9016 14.1276 21.238 14.6659 21.1303C16.8031 20.4088 18.6602 19.0353 19.9758 17.2031C21.2915 15.3708 21.9994 13.1721 22 10.9165C22 4.96848 17.1824 0.150879 11.2344 0.150879Z" /> </svg> </a> </div> <div class="aside-content px-5 py-1 flex-1 overflow-auto"> <select id="redirectSelect.show-laptop" class="select-dropdown p-1 mx-1 my-4 text-black opacity-80 show-laptop border-gray-400"> <option value="/spec/v1.1/verification_summary" class="inline-block">Version 1.1 RC</option> <option selected value="/spec/v1.0/verification_summary" class="inline-block">Version 1.0</option> <option value="/spec/v0.2/verification_summary" class="inline-block">Version 0.2</option> <option value="/spec/v0.1/verification_summary" class="inline-block">Version 0.1</option> <option value="/spec/draft/verification_summary" class="inline-block">Working Draft</option> </select> <script> var selectEl = document.getElementById('redirectSelect.show-laptop'); selectEl.onchange = function(){ var goto = this.value; window.location = goto; }; </script> <nav class="site-nav"><ul><li> <a class="nav-link" href="/spec/v1.0/"> Overview </a> </li><li> Understanding SLSA <ul><li> <a class="nav-link" href="/spec/v1.0/whats-new"> What's new in v1.0 </a> </li><li> <a class="nav-link" href="/spec/v1.0/about"> About SLSA </a> </li><li> <a class="nav-link" href="/spec/v1.0/threats-overview"> Supply chain threats </a> </li><li> <a class="nav-link" href="/spec/v1.0/use-cases"> Use cases </a> </li><li> <a class="nav-link" href="/spec/v1.0/principles"> Guiding principles </a> </li><li> <a class="nav-link" href="/spec/v1.0/faq"> FAQ </a> </li><li> <a class="nav-link" href="/spec/v1.0/future-directions"> Future directions </a> </li> </ul> </li><li> Core specification <ul><li> <a class="nav-link" href="/spec/v1.0/terminology"> Terminology </a> </li><li> <a class="nav-link" href="/spec/v1.0/levels"> Security levels </a> </li><li> <a class="nav-link" href="/spec/v1.0/requirements"> Producing artifacts </a> </li><li> <a class="nav-link" href="/spec/v1.0/distributing-provenance"> Distributing provenance </a> </li><li> <a class="nav-link" href="/spec/v1.0/verifying-artifacts"> Verifying artifacts </a> </li><li> <a class="nav-link" href="/spec/v1.0/verifying-systems"> Verifying build platforms </a> </li><li> <a class="nav-link" href="/spec/v1.0/threats"> Threats & mitigations </a> </li> </ul> </li><li> Attestation formats <ul><li> <a class="nav-link" href="/attestation-model"> General model </a> </li><li> <a class="nav-link" href="/spec/v1.0/provenance"> Provenance </a> </li><li> <a class="nav-link is-active" href="/spec/v1.0/verification_summary"> Verification Summary </a> </li> </ul> </li><li> How to SLSA <ul><li> <a class="nav-link" href="/get-started"> For developers </a> </li><li> <a class="nav-link" href="/how-to-orgs"> For organizations </a> </li><li> <a class="nav-link" href="/how-to-infra"> For infrastructure providers </a> </li> </ul> </li><li> <a class="nav-link" href="/spec-stages"> Specification stages </a> </li><li> <a class="nav-link" href="/community"> Community </a> </li><li> <a class="nav-link" href="/blog"> Blog </a> </li><li> <a class="nav-link" href="/spec/v1.0/onepage"> Single-page view </a> </li> </ul> </nav> </div> </aside> <div class="site-main"> <header class="site-header flex-none" x-data="{ fixed: false, hidden: false, lastPos: window.scrollY, scrolledPast: false }" x-ref="navbar" x-on:scroll.window=" fixed = window.scrollY > lastPos ? window.scrollY >= $refs.navbar.offsetHeight : window.scrollY > 0; hidden = fixed && window.scrollY > lastPos; if (window.scrollY > $refs.navbar.offsetHeight && !scrolledPast) { setTimeout(() => $refs.navbar.classList.add('is-scrolled-past'), 500); scrolledPast = true; } else if (window.scrollY === 0) { $refs.navbar.classList.remove('is-scrolled-past'); scrolledPast = false; } lastPos = window.scrollY; " x-bind:class="{ 'is-fixed': fixed, 'is-hidden': hidden, 'menu-open': navOpen }" > <div class="site-header-inner h-full flex items-center gap-5" > <button x-on:click="navOpen = !navOpen" :class="{ 'active': navOpen }" class="mobile-menu-button inline-block hide-laptop"> </button> <a rel="author" href="/" class="logo block"> <img class="logo-white" src="/images/logo.svg" alt="SLSA logo" /> </a> <select id="redirectSelect.hide-laptop" class="select-dropdown p-1 mx-1 my-4 text-black opacity-80 hide-laptop border-gray-400"> <option value="/spec/v1.1/verification_summary" class="inline-block">Version 1.1 RC</option> <option selected value="/spec/v1.0/verification_summary" class="inline-block">Version 1.0</option> <option value="/spec/v0.2/verification_summary" class="inline-block">Version 0.2</option> <option value="/spec/v0.1/verification_summary" class="inline-block">Version 0.1</option> <option value="/spec/draft/verification_summary" class="inline-block">Working Draft</option> </select> <script> var selectEl = document.getElementById('redirectSelect.hide-laptop'); selectEl.onchange = function(){ var goto = this.value; window.location = goto; }; </script> <a class="desktop-github-icon ml-auto" href="https://github.com/slsa-framework/slsa" target="_blank"> <svg width="22" height="22" viewBox="0 0 22 22" fill="currentColor" xmlns="http://www.w3.org/2000/svg"> <path fill-rule="evenodd" clip-rule="evenodd" d="M11.2344 0.150879C5.28641 0.150879 0.468811 4.96848 0.468811 10.9165C0.468811 15.6803 3.55046 19.7039 7.82978 21.1303C8.36806 21.2245 8.56991 20.9016 8.56991 20.619C8.56991 20.3633 8.55646 19.5155 8.55646 18.6139C5.8516 19.1118 5.15184 17.9545 4.93653 17.3489C4.81541 17.0394 4.29059 16.084 3.83306 15.8283C3.45626 15.6264 2.91798 15.1285 3.8196 15.1151C4.66739 15.1016 5.27295 15.8956 5.47481 16.2185C6.44371 17.8468 7.99126 17.3893 8.61028 17.1067C8.70448 16.4069 8.98708 15.9359 9.29659 15.6668C6.90125 15.3977 4.39825 14.4691 4.39825 10.3513C4.39825 9.18051 4.81541 8.21161 5.50172 7.45802C5.39407 7.18888 5.01727 6.08541 5.60938 4.60514C5.60938 4.60514 6.51099 4.32254 8.56991 5.70861C9.43116 5.46639 10.3462 5.34527 11.2613 5.34527C12.1764 5.34527 13.0914 5.46639 13.9527 5.70861C16.0116 4.30909 16.9132 4.60514 16.9132 4.60514C17.5053 6.08541 17.1285 7.18888 17.0209 7.45802C17.7072 8.21161 18.1244 9.16706 18.1244 10.3513C18.1244 14.4826 15.6079 15.3977 13.2126 15.6668C13.6028 16.0032 13.9392 16.6492 13.9392 17.6584C13.9392 19.0983 13.9258 20.2556 13.9258 20.619C13.9258 20.9016 14.1276 21.238 14.6659 21.1303C16.8031 20.4088 18.6602 19.0353 19.9758 17.2031C21.2915 15.3708 21.9994 13.1721 22 10.9165C22 4.96848 17.1824 0.150879 11.2344 0.150879Z" /> </svg> </a> </div> </header> <main class="site-clamp" aria-label="Content"> <header class="content-header"> <h1 class="mb-16">Verification Summary Attestation (VSA)</h1> </header> <div class="site-content has-toc"> <aside class="table-of-contents flex flex-col">  <div class="rounded-lg p-4 border border-green-900 mt-4 md:mt-0 mb-4"> Status: <a href="/spec-stages" style="display: inline">Approved</a> </div> <div class="flex-auto rounded-lg p-4 border border-green-900 overflow-auto"> On this page <ul><li><a href="#purpose">Purpose</a></li><li><a href="#model">Model</a></li><li><a href="#schema">Schema</a><ul><li><a href="#parsing-rules">Parsing rules</a></li><li><a href="#fields">Fields</a></li></ul></li><li><a href="#example">Example</a></li><li><a href="#emslsaresult-stringem">SlsaResult (String)</a></li><li><a href="#change-history">Change history</a></li></ul> </div> </aside> <div class="content main-content"> Verification summary attestations communicate that an artifact has been verified at a specific SLSA level and details about that verification. This document defines the following predicate type within the <a href="https://github.com/in-toto/attestation">in-toto attestation</a> framework: <div class="language-json highlighter-rouge"><div class="highlight"><pre class="highlight"><code>"predicateType": "https://slsa.dev/verification_summary/v1" </code></pre></div></div> <blockquote> Important: Always use the above string for <code>predicateType</code> rather than what is in the URL bar. The <code>predicateType</code> URI will always resolve to the latest minor version of this specification. See <a href="#parsing-rules">parsing rules</a> for more information. </blockquote> <h2 id="purpose">Purpose</h2> Describe what SLSA level an artifact or set of artifacts was verified at and other details about the verification process including what SLSA level the dependencies were verified at. This allows software consumers to make a decision about the validity of an artifact without needing to have access to all of the attestations about the artifact or all of its transitive dependencies. They can use it to delegate complex policy decisions to some trusted party and then simply trust that party’s decision regarding the artifact. It also allows software producers to keep the details of their build pipeline confidential while still communicating that some verification has taken place. This might be necessary for legal reasons (keeping a software supplier confidential) or for security reasons (not revealing that an embargoed patch has been included). <h2 id="model">Model</h2> A Verification Summary Attestation (VSA) is an attestation that some entity (<code>verifier</code>) verified one or more software artifacts (the <code>subject</code> of an in-toto attestation <a href="https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md">Statement</a>) by evaluating the artifact and a <code>bundle</code> of attestations against some <code>policy</code>. Users who trust the <code>verifier</code> may assume that the artifacts met the indicated SLSA level without themselves needing to evaluate the artifact or to have access to the attestations the <code>verifier</code> used to make its determination. The VSA also allows consumers to determine the verified levels of all of an artifact’s transitive dependencies. The verifier does this by either a) verifying the provenance of each non-source dependency listed in the <a href="/provenance/v1#resolvedDependencies">resolvedDependencies</a> of the artifact being verified (recursively) or b) matching the non-source dependency listed in <code>resolvedDependencies</code> (<code>subject.digest</code> == <code>resolvedDependencies.digest</code> and, ideally, <code>vsa.resourceUri</code> == <code>resolvedDependencies.uri</code>) to a VSA for that dependency and using <code>vsa.verifiedLevels</code> and <code>vsa.dependencyLevels</code>. Policy verifiers wishing to establish minimum requirements on dependencies SLSA levels may use <code>vsa.dependencyLevels</code> to do so. <h2 id="schema">Schema</h2> <div class="language-jsonc highlighter-rouge"><div class="highlight"><pre class="highlight"><code>// Standard attestation fields: "_type": "https://in-toto.io/Statement/v1", "subject": [{ "name": <NAME>, "digest": { <digest-in-request> } }], // Predicate "predicateType": "https://slsa.dev/verification_summary/v1", "predicate": { // Required "verifier": { "id": "<URI>" }, "timeVerified": <TIMESTAMP>, "resourceUri": <artifact-URI-in-request>, "policy": { "uri": "<URI>", "digest": { /* DigestSet */ } } "inputAttestations": [ { "uri": "<URI>", "digest": { <digest-of-attestation-data> } }, ... ], "verificationResult": "<PASSED|FAILED>", "verifiedLevels": ["<SlsaResult>"], "dependencyLevels": { "<SlsaResult>": <Int>, "<SlsaResult>": <Int>, ... }, "slsaVersion": "<MAJOR>.<MINOR>", } </code></pre></div></div> <h3 id="parsing-rules">Parsing rules</h3> This predicate follows the in-toto attestation <a href="https://github.com/in-toto/attestation/blob/main/spec/v1/README.md#parsing-rules">parsing rules</a>. Summary: <ul> <li>Consumers MUST ignore unrecognized fields.</li> <li>The <code>predicateType</code> URI includes the major version number and will always change whenever there is a backwards incompatible change.</li> <li>Minor version changes are always backwards compatible and “monotonic.” Such changes do not update the <code>predicateType</code>.</li> <li>Producers MAY add extension fields using field names that are URIs.</li> </ul> <h3 id="fields">Fields</h3> NOTE: This section describes the fields within <code>predicate</code>. For a description of the other top-level fields, such as <code>subject</code>, see <a href="https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md">Statement</a>. <a id="verifier"></a> <code>verifier</code> object, required <blockquote> Identifies the entity that performed the verification. The identity MUST reflect the trust base that consumers care about. How detailed to be is a judgment call. Consumers MUST accept only specific (signer, verifier) pairs. For example, “GitHub” can sign provenance for the “GitHub Actions” verifier, and “Google” can sign provenance for the “Google Cloud Deploy” verifier, but “GitHub” cannot sign for the “Google Cloud Deploy” verifier. The field is required, even if it is implicit from the signer, to aid readability and debugging. It is an object to allow additional fields in the future, in case one URI is not sufficient. </blockquote> <a id="verifier.id"></a> <code>verifier.id</code> string (<a href="https://github.com/in-toto/attestation/blob/main/spec/v1/field_types.md#TypeURI">TypeURI</a>), required <blockquote> URI indicating the verifier’s identity. </blockquote> <a id="timeVerified"></a> <code>timeVerified</code> string (<a href="https://github.com/in-toto/attestation/blob/main/spec/v1/field_types.md#Timestamp">Timestamp</a>), required <blockquote> Timestamp indicating what time the verification occurred. </blockquote> <a id="resourceUri"></a> <code>resourceUri</code> string (<a href="https://github.com/in-toto/attestation/blob/main/spec/v1/field_types.md#ResourceURI">ResourceURI</a>), required <blockquote> URI that identifies the resource associated with the artifact being verified. </blockquote> <a id="policy"></a> <code>policy</code> object (<a href="https://github.com/in-toto/attestation/blob/main/spec/v1/resource_descriptor.md">ResourceDescriptor</a>), required <blockquote> Describes the policy that the <code>subject</code> was verified against. The entry MUST contain a <code>uri</code>. </blockquote> <a id="inputAttestations"></a> <code>inputAttestations</code> array (<a href="https://github.com/in-toto/attestation/blob/main/spec/v1/resource_descriptor.md">ResourceDescriptor</a>), optional <blockquote> The collection of attestations that were used to perform verification. Conceptually similar to the <code>resolvedDependencies</code> field in <a href="/provenance">SLSA Provenance</a>. This field MAY be absent if the verifier does not support this feature. If non-empty, this field MUST contain information on all the attestations used to perform verification. Each entry MUST contain a <code>digest</code> of the attestation and SHOULD contains a <code>uri</code> that can be used to fetch the attestation. </blockquote> <a id="verificationResult"></a> <code>verificationResult</code> string, required <blockquote> Either “PASSED” or “FAILED” to indicate if the artifact passed or failed the policy verification. </blockquote> <a id="verifiedLevels"></a> <code>verifiedLevels</code> array (<a href="#slsaresult">SlsaResult</a>), required <blockquote> Indicates the highest level of each track verified for the artifact (and not its dependencies), or “FAILED” if policy verification failed. Users MUST NOT include more than one level per SLSA track. Note that each SLSA level implies all levels below it (e.g. <code>SLSA_BUILD_LEVEL_3</code> implies <code>SLSA_BUILD_LEVEL_2</code> and <code>SLSA_BUILD_LEVEL_1</code>), so there is no need to include more than one level per track. </blockquote> <a id="dependencyLevels"></a> <code>dependencyLevels</code> object, optional <blockquote> A count of the dependencies at each SLSA level. Map from <a href="#slsaresult">SlsaResult</a> to the number of the artifact’s transitive dependencies that were verified at the indicated level. Absence of a given level of <a href="#slsaresult">SlsaResult</a> MUST be interpreted as reporting 0 dependencies at that level. A set but empty <code>dependencyLevels</code> object means that the artifact has no dependency at all, while an unset or null <code>dependencyLevels</code> means that the verifier makes no claims about the artifact’s dependencies. Users MUST count each dependency only once per SLSA track, at the highest level verified. For example, if a dependency meets <code>SLSA_BUILD_LEVEL_2</code>, you include it with the count for <code>SLSA_BUILD_LEVEL_2</code> but not the count for <code>SLSA_BUILD_LEVEL_1</code>. </blockquote> <a id="slsaVersion"></a> <code>slsaVersion</code> string, optional <blockquote> Indicates the version of the SLSA specification that the verifier used, in the form <code><MAJOR>.<MINOR></code>. Example: <code>1.0</code>. If unset, the default is an unspecified minor version of <code>1.x</code>. </blockquote> <h2 id="example">Example</h2> WARNING: This is just for demonstration purposes. <div class="language-jsonc highlighter-rouge"><div class="highlight"><pre class="highlight"><code>"_type": "https://in-toto.io/Statement/v1", "subject": [{ "name": "out/example-1.2.3.tar.gz", "digest": {"sha256": "5678..."} }], // Predicate "predicateType": "https://slsa.dev/verification_summary/v1", "predicate": { "verifier": { "id": "https://example.com/publication_verifier" }, "timeVerified": "1985-04-12T23:20:50.52Z", "resourceUri": "https://example.com/example-1.2.3.tar.gz", "policy": { "uri": "https://example.com/example_tarball.policy", "digest": {"sha256": "1234..."} }, "inputAttestations": [ { "uri": "https://example.com/provenances/example-1.2.3.tar.gz.intoto.jsonl", "digest": {"sha256": "abcd..."} } ], "verificationResult": "PASSED", "verifiedLevels": ["SLSA_BUILD_LEVEL_3"], "dependencyLevels": { "SLSA_BUILD_LEVEL_3": 5, "SLSA_BUILD_LEVEL_2": 7, "SLSA_BUILD_LEVEL_1": 1, }, "slsaVersion": "1.0" } </code></pre></div></div> <div id="slsaresult"> <h2 id="emslsaresult-stringem">SlsaResult (String)</h2> </div> The result of evaluating an artifact (or set of artifacts) against SLSA. SHOULD be one of these values: <ul> <li><code>SLSA_BUILD_LEVEL_0</code></li> <li><code>SLSA_BUILD_LEVEL_1</code></li> <li><code>SLSA_BUILD_LEVEL_2</code></li> <li><code>SLSA_BUILD_LEVEL_3</code></li> <li><code>FAILED</code> (Indicates policy evaluation failed)</li> </ul> Note that each SLSA level implies the levels below it in the same track. For example, <code>SLSA_BUILD_LEVEL_3</code> means (<code>SLSA_BUILD_LEVEL_1</code> + <code>SLSA_BUILD_LEVEL_2</code> + <code>SLSA_BUILD_LEVEL_3</code>). Users MAY use custom values here but MUST NOT use custom values starting with <code>SLSA_</code>. <h2 id="change-history">Change history</h2> <ul> <li>1: <ul> <li>Replaced <code>materials</code> with <code>resolvedDependencies</code>.</li> <li>Relaxed <code>SlsaResult</code> to allow other values.</li> <li>Converted to lowerCamelCase for consistency with <a href="/provenance">SLSA Provenance</a>.</li> <li>Added <code>slsaVersion</code> field.</li> </ul> </li> <li>0.2: <ul> <li>Added <code>resource_uri</code> field.</li> <li>Added optional <code>input_attestations</code> field.</li> </ul> </li> <li>0.1: Initial version.</li> </ul> <div class="mt-10 pt-10 border-t flex flex-col sm:flex-row space-between gap-5"> <a href="/spec/v1.0/provenance" class="border rounded px-4 py-2 text-left">&lsaquo; Provenance</a> </div> </div> </div> </main><footer class="site-footer flex-none h-card text-white"> <div class="site-clamp py-4 flex flex-wrap items-start justify-between w-full"> <div class="w-full md:w-1/3 mb-8 md:mb-0"> SLSA is a cross-industry collaboration. © 2024 The Linux Foundation, under the terms of the <a href="https://github.com/slsa-framework/governance">Community Specification License 1.0</a> </div> <div class="w-full md:w-1/3 mb-8 md:mb-0"> Privacy statement We use <a href="https://goatcounter.com">GoatCounter</a> to help us improve our website by collecting and reporting information on how it's used. We do not store advertising or tracking cookies. The information we collect does not identify anyone and does not track an individual's use of the site. </div> <div class="w-full md:w-1/4 mb-8 md:mb-0 flex md:justify-end"> <a href="https://github.com/slsa-framework/slsa/blob/910587ad00cc1f893b1e1ef6af3fb00c382e72f3/docs/spec/v1.0/verification_summary.md?plain=1" target="_blank" class="flex gap-4 h5 font-normal"> View source on GitHub <svg width="22" height="22" viewBox="0 0 22 22" fill="none" xmlns="http://www.w3.org/2000/svg"> <path fill-rule="evenodd" clip-rule="evenodd" d="M11.2344 0.150879C5.28641 0.150879 0.468811 4.96848 0.468811 10.9165C0.468811 15.6803 3.55046 19.7039 7.82978 21.1303C8.36806 21.2245 8.56991 20.9016 8.56991 20.619C8.56991 20.3633 8.55646 19.5155 8.55646 18.6139C5.8516 19.1118 5.15184 17.9545 4.93653 17.3489C4.81541 17.0394 4.29059 16.084 3.83306 15.8283C3.45626 15.6264 2.91798 15.1285 3.8196 15.1151C4.66739 15.1016 5.27295 15.8956 5.47481 16.2185C6.44371 17.8468 7.99126 17.3893 8.61028 17.1067C8.70448 16.4069 8.98708 15.9359 9.29659 15.6668C6.90125 15.3977 4.39825 14.4691 4.39825 10.3513C4.39825 9.18051 4.81541 8.21161 5.50172 7.45802C5.39407 7.18888 5.01727 6.08541 5.60938 4.60514C5.60938 4.60514 6.51099 4.32254 8.56991 5.70861C9.43116 5.46639 10.3462 5.34527 11.2613 5.34527C12.1764 5.34527 13.0914 5.46639 13.9527 5.70861C16.0116 4.30909 16.9132 4.60514 16.9132 4.60514C17.5053 6.08541 17.1285 7.18888 17.0209 7.45802C17.7072 8.21161 18.1244 9.16706 18.1244 10.3513C18.1244 14.4826 15.6079 15.3977 13.2126 15.6668C13.6028 16.0032 13.9392 16.6492 13.9392 17.6584C13.9392 19.0983 13.9258 20.2556 13.9258 20.619C13.9258 20.9016 14.1276 21.238 14.6659 21.1303C16.8031 20.4088 18.6602 19.0353 19.9758 17.2031C21.2915 15.3708 21.9994 13.1721 22 10.9165C22 4.96848 17.1824 0.150879 11.2344 0.150879Z" fill="white"/> </svg> </a> This site is powered by <a href="https://www.netlify.com">Netlify</a> </div> </div> <div class="site-clamp py-4 flex items-start justify-between w-full mb-16 md:mb-0"> <a rel="author" href="/"><img src="/images/logo.svg" alt="SLSA logo" /></a> </div> </footer> </div> </body> </html>