-
@hythloda proposed using Infrastructure as Code approach to codify organization and repositories, we need to start automating manual work.
-
**Is your feature request related to a problem? Please describe.**
There is no support for offline verification currently. While a certificate is persisted in the DSSE signature, the Rekor entry pr…
-
I am trying to assess the SLSA level when using Nix referring to the SLSA v1.0, published in April 2023. Since it requires less than its draft versions, I presume compliance is quite straightforward. …
-
This is a tracking issue for releasing v1.1. The primary goal of v1.1 is to release small updates to v1.0 to address issues that are too significant for an in-place update to v1.0 yet we don't want to…
kpk47 updated
2 months ago
-
Models that are saved as a directory (e.g., TF's SavedModel) require SLSA changes to record the hash. This is different that what we use for signing, where we can compute a directory hash.
Until we…
-
### What would you like to be added?
Please add [SLSA provenance ](https://slsa.dev/)to your releases.
It is easy to do on on Github:
https://github.com/slsa-framework/slsa-github-generator/blo…
-
I am using please build and would love to see some provenance attestation data being output when I run the build. Lately the requests in open source for provenance data is growing and also in the busi…
-
**Description**
I'm trying to use `kubectl-sigstore sign --no-tlog-upload` offline, but I still get the "The sigstore service, hosted by sigstore" warning.
When I try `kubectl-sigstore sign -f v…
-
At the moment we use cosign to sign our payload. Cosign brings in a lot of dependencies.
We could replace it with something like this https://github.com/slsa-framework/slsa-github-generator/blob/c…
-
verified timestamps are provided by the SCP, so when I migrate the source to a new SCP, I think this means that the org must keep the original repo around to keep the "true" timestamps. …