Learn vocabulary for SLSA (Supply chain Levels for Software Artifacts): levels, provenance, attestation, and build integrity.
0 / 10 completed
1 / 10
What does 'SLSA' stand for and what is its purpose?
SLSA (pronounced 'salsa', Google, now OpenSSF): a framework of increasingly rigorous supply chain security requirements, from SLSA 1 (basic documentation) to SLSA 4 (fully hermetic, reproducible builds with two-party review). It provides a common vocabulary and measurable levels for software build integrity.
2 / 10
What is 'provenance attestation' in SLSA vocabulary?
Provenance attestation (SLSA): cryptographically signed metadata stating: this artifact was built from commit X at time Y using build system Z on runner W. Consumers can verify: was this artifact actually built from the source I audited? Was it built on a trusted build system? Has it been tampered with after build?
3 / 10
What is a 'hermetic build' in SLSA vocabulary?
Hermetic build: the build process has no access to external network or mutable file system inputs — only the explicitly declared, pinned, verified dependencies. This prevents: downloading malicious packages during build, using different dependency versions on different runs, and other build-time injection attacks. Required for SLSA level 3+.
4 / 10
What is 'two-party review' in SLSA supply chain vocabulary?
SLSA level 4 two-party review: no code may be committed without review by a different person. This prevents a single compromised or malicious developer from unilaterally introducing backdoors — the SolarWinds attack vector. Two-party review is a control against insider threats and compromised developer credentials.
5 / 10
What is 'artifact signing' in supply chain security vocabulary?
Artifact signing (Sigstore/cosign, GPG): the build system signs the artifact with a private key. Consumers verify the signature using the public key before using the artifact. This detects tampering in transit (package registry compromise, man-in-the-middle) and impersonation (fake packages pretending to be from a trusted publisher).
6 / 10
Alice from the Security team just sent you this Slack message: 'Hey, I'm seeing some concerns about the build artifacts generated by the slsa build command. The output isn't clearly tied to a verifiable source, and there are no signatures on any of them. What does provenance refer to in this context?',
Which of the following best explains Alice's concern?
Alice's message highlights a key aspect of SLSA: traceability. Provenance refers to the ability to track an artifact's journey – who created it, when it was built, and how it has been modified. The lack of clear links and signatures indicates a missing provenance record, which is central to SLSA's security and auditability goals.
7 / 10
Ben is writing the description for a Pull Request he's submitting. He wants to explain why he followed the SLSA guidelines. Which of the following best describes how Ben should phrase his PR description regarding 'hermetic builds'?
A 'hermetic build' is a core concept in SLSA designed to guarantee reproducibility and security. It signifies that all dependencies are explicitly defined and controlled during the build process, preventing vulnerabilities introduced by external changes or unknown components. Ben should clearly state this immutability as it's a key benefit of using hermetic builds.
8 / 10
Charlie is reviewing a code change. The developer has included an artifact signing step in the build process. What is the primary purpose of this signature?
Artifact signing is a critical security component of SLSA. The digital signature provides cryptographic proof that the artifact originated from a trusted source and hasn't been altered during transit or storage. This enables verification of authenticity and prevents malicious modifications, bolstering supply chain security.
9 / 10
David is discussing SLSA with a new team member. He says, 'We're using a two-party review process to ensure higher quality.' What does 'two-party review' typically involve in the context of SLSA?
'Two-party review' in SLSA refers to a collaborative approach where at least two distinct individuals—often with different expertise or roles—independently scrutinize a change before it is integrated into the codebase. This significantly reduces the risk of overlooked defects and vulnerabilities compared to single-reviewer processes.
10 / 10
Emily needs to explain the concept of 'SLSA' to a non-technical stakeholder. Which of the following explanations would be most effective?
The stakeholder needs an accessible explanation of SLSA's core purpose. It isn't just a tool; it's a *framework*—a structured approach to building software with security and traceability in mind. Emphasizing provenance, reproducibility, and verification provides the most relevant information for a non-technical audience.
What will I learn from the "SLSA Framework — Vocabulary and Communication" exercise?
Learn vocabulary for SLSA (Supply chain Levels for Software Artifacts): levels, provenance, attestation, and build integrity.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Supply Chain Security exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss supply chain security topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Supply Chain Security exercises?
See the full Supply Chain Security exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.