---
id: 1452
title: "Securing the software supply chain with the SLSA framework"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2024/10/01/securing-the-software-supply-chain-with-the-slsa-framework/"
published_at: "2024-10-01 13:00"
tags: ["supply-chain", "open-source", "pypi", "supply-chain-security", "pep-740", "provenance", "slsa"]
phying_url: "https://phying.com/item/1452"
lang: en
---

# Securing the software supply chain with the SLSA framework

## Summary

An overview of the SLSA framework's Build Levels 1-3, signed build provenance from CI/CD platforms, PEP 740 bringing SLSA provenance to PyPI, and how consumers can verify artifact origins.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2024-10-01 13:00
- **Original:** https://blog.trailofbits.com/2024/10/01/securing-the-software-supply-chain-with-the-slsa-framework/
- **Phying News:** https://phying.com/item/1452