Skip to main content
New2026 CISO Guide to Software Trust87% of public container images ship with high or critical CVEs.Get the guide
CleanStart

SLSA Levels as Architectural States of Trust

View Architecture Insights
SLSA Levels as Architectural States of Trust

Software compromised during build and packaging cannot be secured later by scanning, runtime controls or policy, as SolarWinds and the XZ Utils backdoor showed. This architecture insight reframes SLSA levels as states of trust: provenance that is informational at Levels 0 and 1, signed at Level 2, a hermetic, isolated build at Level 3, and reproducible, independently verified builds with two-person review at Level 4. It explains how CleanStart treats Levels 3 and 4 as the baseline, so teams consume artifacts that already meet them instead of retrofitting controls into each CI pipeline.