SLSA 1.2: a Source track to secure code before the build

2025-11-24 · Publisher : SLSA (Linux Foundation) · Domain : Cloud & DevOps

On 24 November 2025, the SLSA framework publishes version 1.2, adding the Source track: it covers threats from the authoring, review and management of source code. It remains compatible with 1.1.

### Background On 24 November 2025, SLSA (Supply-chain Levels for Software Artifacts), a software supply chain security framework developed under the Linux Foundation, publishes version 1.2. Its main addition is the Source Track, which addresses threats specific to the authoring, review and management of source code. ### Key facts - Release candidates published in June and again in November 2025, with a community review phase. - Version 1.2 is backward compatible with 1.1. - The Source track complements the Build track: it adds guarantees on history, enforced controls and code review. - Two further tracks are in preparation: the build environment (Build Environment Track) and dependencies (Dependency Track). - SLSA is a cross-industry collaboration that follows the Linux Foundation's "Community Specification" lifecycle. ### Why it matters The 2025 attacks (tj-actions, Shai-Hulud) targeted maintainer accounts, workflows and repositories as much as artifacts. SLSA's Source track formalizes what must be demonstrated upstream of the build: who changed the code, with what review, in which repository. For consulting firms building delivery chains for clients subject to the CRA or NIS2, it is a reusable evidence framework. SLSA 1.2 is not a tool but a specification: its value depends on the tooling (build platforms, registries, attestations) that implements it. ### Takeaway SLSA now covers source code as well as the build: an evidence framework to answer attacks on accounts and workflows.

Tags : Sécurité, CI/CD, Open Source, DevOps