SLSA
Build track: producer requirements – SLSA

SLSA BP.3: Distribute provenance to consumers (Build L1 to L3)

What does BP.3 require?

The producer must make provenance available to the consumers of its artifacts. It may hand this duty to the package ecosystem, but only where the ecosystem can actually distribute provenance.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Build track: producer requirements – SLSA

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SLSA controls