-
example scenario: check if an image was built from a specific repo, with a specific branch/commit, include certain reviewers, etc
https://slsa.dev/provenance/v0.2
-
### Problem
> Any software can introduce vulnerabilities into a supply chain. As a system gets more complex, it’s critical to already have checks and best practices in place to guarantee artifact i…
rugk updated
2 months ago
-
### System information
Supply-chain Levels for Software Artifacts (SLSA V1.0) [Level 2](https://slsa.dev/spec/v1.0/levels#build-l2) requires to have digital signatures on build artifacts, such as P…
-
during the specification meeting, when reviewing the Terms and Definitions, it was called out that the usage of "provenance" is very specific to NIST and differs from the SLSA,etc definition. while th…
-
### Describe the issue
frizbee fails to pin the version of the `ruby/setup-ruby` action when the version is `setup-ruby@v1`.
### To Reproduce
* Download the following github action file: `wge…
-
An off-line mode would enable the use of `slsa-verifier` in air-gapped environments, which are isolated from any network connection for security reasons.
Cosign [already support this](https://githu…
pjbgf updated
3 months ago
-
~~When adding a "Harden Runner" to an action, it doesn't check if there is already an runner present.~~
It seems it only adds an duplicate runner when https://github.com/slsa-framework/slsa-github-ge…
-
**What would you like to be added**:
SLSA Attestation to be generated with new releases.
**Why is this needed**:
SLSA's are resources that show evidence that the release consumers receive has…
-
@laurentsimon filed [this bug](https://github.com/slsa-framework/slsa/issues/797) in slsa-framework, but we probably need to consider it here too.
Do we need to provide any guidance for dealing wit…
-
The current documentation seems to refer to two separate ladders.
- The SLSA build ladder, which currently goes from 0 to 3, and the value is dependent on the builder, not policy verification.
- T…