Skip to content

SLSA badges: align with v1.0

SLSA v1.0 has quite some changes compared to 0.1 we based the current badge on:

  • They created the concept of tracks (Source, Build, ...). v1.0 only the Build track is being taken into account
  • Levels are now specified by track (again, only 1 track for now)
  • Source track has 4 levels: L[0-3], L4 is gone

To align with the new concepts, I suggest:

  • replace the global SLSA level dropdown with a "Build Track Level" dropdown. The idea is to make it easy to add some more tracks in the future.
  • update the links in the description to https://slsa.dev/spec/v1.0/levels and https://slsa.dev/spec/v1.0/requirements
  • rename current field in API from slsa_level to slsa_build_level (or to a more complex object: "slsa": {"build_level": 2})
  • migrate the current data, dropping everything that is L4 (I think that no project has that)
  • the icon and text on the project page will need to be adjusted, but I don't know how exactly for now (I'll provide some text / icon once we get there).
Edited by Mikaël Barbero