SLSA Verification Policy and Compliance Criteria

This policy defines the evidence requirements and verification criteria used to assert SLSA Level 3 compliance.

A verification result of PASSED indicates that all required claims below were validated against trusted evidence.

The verifier attests that:

• The repository identity was verified.
• The source commit exists in the declared repository.
• The source commit is identified by an immutable commit digest.
• The source commit was reachable from an authorized repository reference at verification time.
• Protected branches prevent unauthorized direct modification.
• Protected branches require code review prior to merge.
• Repository controls prevent unauthorized modification of verified history.
• The source provenance accurately identifies the repository, commit, and repository references.
• All source evidence was collected from trusted repository metadata and attestations.
• No source integrity violations were detected.

The verifier attests that:

• The build was executed by an identified and trusted build platform.
• The builder identity was verified.
• The build was initiated from the verified source commit.
• The build definition originated from version-controlled source.
• The build execution generated signed provenance.
• The provenance was generated by the build platform and not supplied by the build initiator.
• The provenance identifies the builder, source inputs, build definition, and produced artifacts.
• The artifact digests match the artifacts described in provenance.
• Build execution occurred within an isolated build environment.
• Build execution was protected from unauthorized modification.
• Nobuild integrity violations were detected.