Verification · Supply chain · SBOM and provenance
Signing and attestation
Sign artifacts and attach build provenance (SLSA).
How to build it
- Sign each release artifact in CI with keyless signing tied to the workflow identity.
- Generate SLSA build provenance for the artifact in the release workflow.
- Verify the signature and provenance before a deployment step runs.
Signals in a repository
- A cosign sign or cosign sign-blob step in a release workflow.
- A *.intoto.jsonl provenance asset, or permissions: id-token: write on the release job.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.