How the v0.3.0 release pipeline maps to NIST and SLSA

If you have to explain our release pipeline to a security reviewer, start here. This page puts each stage of the new release pipeline next to the NIST practice it was designed against, and says where a stage only partly implements a practice.

DRAFT for v0.3.0, not published and never merged before v0.3.0 is live. [TO-VERIFY] marks anything not yet run against a real release.

This is guidance we followed when designing the pipeline. It is not a certification.

Stage by stage

The six stages are described step by step on how we build. "Signs" means the stage records what it did and signs it with a short-lived key, under its own workflow identity, logged in a public transparency log. [TO-VERIFY] against the workflow files at the v0.3.0 tag.

Stage	What it does	NIST practice	How much
Source admission	`[TO-VERIFY]` whether unchanged from v0.2.2: signed tag, signed commit on `main`, required checks passed.	`[TO-VERIFY]` 800-204D 5.1.4 and 5.1.2	`[TO-VERIFY]`
Build	`[TO-VERIFY]` Builds the binaries and the signed packages once. The image is assembled from those packages, with no base image.	`[TO-VERIFY]` 800-204D 5.1.1	`[TO-VERIFY]`
Sign	`[TO-VERIFY]` A separate stage records the build and signs it under its own identity, from the build's digest list only.	`[TO-VERIFY]` the part of 5.1.1 that asks for signing outside the build steps	`[TO-VERIFY]`
Rebuild	`[TO-VERIFY]` Builds the release again, independently. The digests must match or the release fails.	`[TO-VERIFY]` none found in either document	`[TO-VERIFY]`
Check	`[TO-VERIFY]` Scans and acceptance tests run against the exact candidate images, and the stage signs a verdict for those digests.	`[TO-VERIFY]` 800-204C 4.8 and 800-204D 5.2	`[TO-VERIFY]`
Release	`[TO-VERIFY]` Verifies every stage's signature together, then publishes the same digests.	`[TO-VERIFY]`	`[TO-VERIFY]`

Our wording: signed at every stage, verified together at release. [TO-VERIFY: pipeline]

SLSA

[TO-VERIFY] The SLSA Build level we assess v0.3.0 at. We claim Level 3 for the Build stage only after a test shows that a malicious build step cannot produce provenance the release step accepts. Until that test has passed, this page says nothing about Level 3.

What this page does not say

No stage here is certified by anyone.
Parts of both NIST documents cover running services in your own cluster. That is your environment, so this page does not map it.