# slsa levels

SLSA levels are incrementally adoptable security guidelines and tracks that measure software supply-chain security, including build provenance and protection against tampering.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Chainguard conducts SLSA software supply chain security audit of open source project Git

DevFeed: [Chainguard conducts SLSA software supply chain security audit of open source project Git](<https://devfeed.tech/articles/chainguard-conducts-slsa-software-supply-chain-security-audit-of-open-source-project-git-12934.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-conducts-slsa-software-supply-chain-security-audit-of-open-source-project-git>)

Published: 2023-03-01T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Git](<https://devfeed.tech/topics/git.md>), [slsa levels](<https://devfeed.tech/topics/slsa-levels.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [GitLab](<https://devfeed.tech/topics/gitlab.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-labs](<https://devfeed.tech/tags/chainguard-labs.md>), [git](<https://devfeed.tech/tags/git.md>), [gitlab](<https://devfeed.tech/tags/gitlab.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [open-source-technology-improvement-fund](<https://devfeed.tech/tags/open-source-technology-improvement-fund.md>), [ostif](<https://devfeed.tech/tags/ostif.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [security](<https://devfeed.tech/tags/security.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>)

### AI overview

Chainguard, GitLab, and OSTIF audit Git and git-for-windows using the SLSA framework to examine software supply chain security practices. The article finds that SLSA is a poor fit for Git because Git releases source code rather than built artifacts, while git-for-windows can be assessed through the framework. It also reports that Git's contributor community and existing tooling provide protection consistent with SLSA's goals, despite practices that are not machine-readable or machine-verifiable.

### Source excerpt

Chainguard, GitLab and OSTIF conduct a software supply chain security audit of the open source git project using SLSA levels.