WeSearch

SLSA Provenance Hands-on: Generate with GitHub Actions, Verify with slsa-verifier

·11 min read · 0 reactions · 0 comments · 0 views
SLSA Provenance Hands-on: Generate with GitHub Actions, Verify with slsa-verifier

After SBOM and Cosign comes Provenance. Issue SLSA Build L3 provenance with slsa-github-generator and verify it with slsa-verifier, end to end on real machines.

Original article
DEV.to (Top)
Read full at DEV.to (Top) →
Opening excerpt (first ~120 words) tap to expand

try { if(localStorage) { let currentUser = localStorage.getItem('current_user'); if (currentUser) { currentUser = JSON.parse(currentUser); if (currentUser.id === 3700180) { document.getElementById('article-show-container').classList.add('current-user-is-article-author'); } } } } catch (e) { console.error(e); } kt Posted on Apr 29 SLSA Provenance Hands-on: Generate with GitHub Actions, Verify with slsa-verifier #security #supplychain #slsa #sigstore Supply Chain Security (5 Part Series) 1 Supply Chain Security: A Deep Dive into SBOM and Code Signing 2 Sigstore Deep Dive: Unmasking the Magic Behind Keyless Verification 3 SLSA Deep Dive: Securing the Supply Chain Using Verifiable Levels 4 Why Did Docker Abandon TUF?: A Turbulent History of Container Signing 5 SLSA Provenance Hands-on:…

Excerpt limited to ~120 words for fair-use compliance. The full article is at DEV.to (Top).

Anonymous · no account needed
Share 𝕏 Facebook Reddit LinkedIn Threads WhatsApp Bluesky Mastodon Email

Discussion

0 comments

More from DEV.to (Top)