diff --git a/docs/spec/v1.1/levels.md b/docs/spec/v1.1/levels.md index 537e9c540..35bb1bd18 100644 --- a/docs/spec/v1.1/levels.md +++ b/docs/spec/v1.1/levels.md @@ -95,19 +95,19 @@ but is trivial to bypass or forge. Projects and organizations wanting to easily and quickly gain some benefits of SLSA---other than tamper protection---without changing their build workflows. -
Software Producer Requirements
+
Requirements
-- Follow a consistent build process so that others can form expectations - about what a "correct" build looks like. +- **Software producer:** -- Distribute provenance to consumers, preferably using a convention - determined by the package ecosystem. + - Follow a consistent build process so that others can form + expectations about what a "correct" build looks like. -
Build Platform Requirements
+ - Distribute provenance to consumers, preferably using a convention + determined by the package ecosystem. -- Automatically generate [provenance] describing how the artifact was - built, including: what entity built the package, what build process they - used, and what the top-level input to the build were. +- **Build platform:** Automatically generate [provenance] describing how + the artifact was built, including: what entity built the package, what + build process they used, and what the top-level input to the build were.
Benefits
@@ -149,22 +149,19 @@ Projects and organizations wanting to gain moderate security benefits of SLSA by switching to a hosted build platform, while waiting for changes to the build platform itself required by [Build L3]. -
Software Producer Requirements
+
Requirements
All of [Build L1], plus: -- Run builds on a hosted build platform that meets Build L2 requirements. - -- Enable downstream verifiers of provenance to validate the authenticity - of the provenance. - -
Build Platform Requirements
+- **Software producer:** Run builds on a hosted build platform that meets + Build L2 requirements. -All of [Build L1], plus: +- **Build platform:** Generate and sign[^sign] the provenance itself. This + may be done during the original build, an after-the-fact reproducible + build, or some equivalent platform that ensures the trustworthiness of + the provenance. -- Generate and sign[^sign] the provenance itself. This may be done during - the original build, an after-the-fact reproducible build, or some - equivalent platform that ensures the trustworthiness of the provenance. +- **Consumer:** Validate the authenticity of the provenance.
Benefits
@@ -204,19 +201,18 @@ strong tamper protection. Most software releases. Build L3 usually requires significant changes to existing build platforms. -
Software Producer Requirements
+
Requirements
All of [Build L2], plus: -- Run builds on a hosted build platform that meets Build L3 requirements. +- **Software producer:** Run builds on a hosted build platform that meets + Build L3 requirements. -
Build Platform Requirements
- -All of [Build L2], plus: +- **Build platform:** Implement strong controls to: -- Implement strong controls to: + - prevent runs from influencing one another, even within the same + project. - - prevent runs from influencing one another, even within the same project. - prevent secret material used to sign the provenance from being accessible to the user-defined build steps.