All SLSA specification content contributed following adoption of the Community Specification governance model is provided under the Community Specification License 1.0 (Community-Spec-1.0).
Pre-existing portions of the SLSA specification from contributors who have not subsequently contributed under the Community Specification License 1.0 following its adoption are provided under the Apache License, version 2.0 (Apache-2.0).
SLSA source code and software, where not otherwise specified, is provided under the Apache License, version 2.0 (Apache-2.0).