Terminology

Before diving into the SLSA Levels, we need to establish a core set of terminology and models to describe what we’re protecting.

Software supply chain

TODO: Update the text to match the new diagram.

SLSA’s framework addresses every step of the software supply chain - the sequence of steps resulting in the creation of an artifact. We represent a supply chain as a directed acyclic graph of sources, builds, dependencies, and packages. One artifact’s supply chain is a combination of its dependencies’ supply chains plus its own sources and builds.

Term	Description	Example
Artifact	An immutable blob of data; primarily refers to software, but SLSA can be used for any artifact.	A file, a git commit, a directory of files (serialized in some way), a container image, a firmware image.
Attestation	An authenticated statement (metadata) about a software artifact or collection of software artifacts.	A signed SLSA Provenance file.
Source	Artifact that was directly authored or reviewed by persons, without modification. It is the beginning of the supply chain; we do not trace the provenance back any further.	Git commit (source) hosted on GitHub (platform).
Build	Process that transforms a set of input artifacts into a set of output artifacts. The inputs may be sources, dependencies, or ephemeral build outputs.	.travis.yml (process) run by Travis CI (platform).
Package	Artifact that is “published” for use by others. In the model, it is always the output of a build process, though that build process can be a no-op.	Docker image (package) distributed on DockerHub (platform). A ZIP file containing source code is a package, not a source, because it is built from some other source, such as a git commit.
Dependency	Artifact that is an input to a build process but that is not a source. In the model, it is always a package.	Alpine package (package) distributed on Alpine Linux (platform).

Roles

Throughout the specification, you will see reference to the following roles that take part in the software supply chain. Note that in practice a role may be filled by more than one person or an organization. Similarly, a person or organization may act as more than one role in a particular software supply chain.

Role	Description	Examples
Producer	A party who creates software and provides it to others. Producers are often also consumers.	An open source project’s maintainers. A software vendor.
Verifier	A party who inspect an artifact’s provenance to determine the artifact’s authenticity.	A business’s software ingestion system. A programming language ecosystem’s package registry.
Consumer	A party who uses software provided by a producer. The consumer may verify provenance for software they consume or delegate that responsibility to a separate verifier.	A developer who uses open source software distributions. A business that uses a point of sale system.
Infrastructure provider	A party who provides software or services to other roles.	A package registry’s maintainers. A build platform’s maintainers.

Package model

Software is distributed in identifiable units called packages according to the rules and conventions of a package ecosystem. Examples of formal ecosystems include Python/PyPA, Debian/Apt, and OCI, while examples of informal ecosystems include links to files on a website or distribution of first-party software within a company.

Abstractly, a consumer locates software within an ecosystem by asking a package registry to resolve a mutable package name into an immutable package artifact.¹ To publish a package artifact, the software producer asks the registry to update this mapping to resolve to the new artifact. The registry represents the entity or entities with the power to alter what artifacts are accepted by consumers for a given package name. For example, if consumers only accept packages signed by a particular public key, then it is access to that public key that serves as the registry.

The package name is the primary security boundary within a package ecosystem. Different package names represent materially different pieces of software—different owners, behaviors, security properties, and so on. Therefore, the package name is the primary unit being protected in SLSA. It is the primary identifier to which consumers attach expectations.

Term	Description
Package	An identifiable unit of software intended for distribution, ambiguously meaning either an “artifact” or a “package name”. Only use this term when the ambiguity is acceptable or desirable.
Package artifact	A file or other immutable object that is intended for distribution.
Package ecosystem	A set of rules and conventions governing how packages are distributed, including how clients resolve a package name into one or more specific artifacts.
Package manager client	Client-side tooling to interact with a package ecosystem.
Package name	The primary identifier for a mutable collection of artifacts that all represent different versions of the same software. This is the primary identifier that consumers use to obtain the software. A package name is specific to an ecosystem + registry, has a maintainer, is more general than a specific hash or version, and has a “correct” source location. A package ecosystem may group package names into some sort of hierarchy, such as the Group ID in Maven, though SLSA does not have a special term for this.
Package registry	An entity responsible for mapping package names to artifacts within a packaging ecosystem. Most ecosystems support multiple registries, usually a single global registry and multiple private registries.
Publish [a package]	Make an artifact available for use by registering it with the package registry. In technical terms, this means associating an artifact to a package name. This does not necessarily mean making the artifact fully public; an artifact may be published for only a subset of users, such as internal testing or a closed beta.

Ambiguous terms to avoid

• Package repository: Could mean either package registry or package name, depending on the ecosystem. To avoid confusion, we always use “repository” exclusively to mean “source repository”, where there is no ambiguity.
• Package manager (without “client”): Could mean either package ecosystem, package registry, or client-side tooling.

Mapping to real-world ecosystems

Most real-world ecosystems fit the package model above but use different terms. The table below attempts to document how various ecosystems map to the SLSA Package model. There are likely mistakes and omissions; corrections and additions are welcome!

Package ecosystem	Package registry	Package name	Package artifact
Languages
Cargo (Rust)	Registry	Crate name	Artifact
CPAN (Perl)	Upload server	Distribution	Release (or Distribution)
Go	Module proxy	Module path	Module
Maven (Java)	Repository	Group ID + Artifact ID	Artifact
npm (JavaScript)	Registry	Package Name	Package
NuGet (C#)	Host	Project	Package
PyPA (Python)	Index	Project Name	Distribution
Operating systems
Dpkg (e.g. Debian)	?	Package name	Package
Flatpak	Repository	Application	Bundle
Homebrew (e.g. Mac)	Repository (Tap)	Package name (Formula)	Binary package (Bottle)
Pacman (e.g. Arch)	Repository	Package name	Package
RPM (e.g. Red Hat)	Repository	Package name	Package
Nix (e.g. NixOS)	Repository (e.g. Nixpkgs) or binary cache	Derivation name	Derivation or store object
Storage systems
GCS	n/a	Object name	Object
OCI/Docker	Registry	Repository	Object
Meta
deps.dev: System	Packaging authority	Package	n/a
purl: type	Namespace	Name	n/a

Notes:

• Go uses a significantly different distribution model than other ecosystems. In go, the package name is a source repository URL. While clients can fetch directly from that URL—in which case there is no “package” or “registry”—they usually fetch a zip file from a module proxy. The module proxy acts as both a builder (by constructing the package artifact from source) and a registry (by mapping package name to package artifact). People trust the module proxy because builds are independently reproducible and a checksum database guarantees that all clients receive the same artifact for a given URL.

1. This resolution might include a version number, label, or some other selector in addition to the package name, but that is not important to SLSA. ↩