-
Please consider adding [SLSA provenance](https://slsa.dev/) to your releases, e.g. via [GitHub Artifact attestations](https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-availa…
-
**Motivation**
We have signatures with cosign, and our next step is to add provenance attestations to images and artifacts as well, in the same way we have in Falcoctl
cc @cpanato @developer-guy
-
Please add [SLSA provenance ](https://slsa.dev/)to your releases.
It is quick and easy to do on on Github:
https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/gen…
-
Please add [SLSA provenance ](https://slsa.dev/)to your releases.
It is easy to do on on Github, for example:
https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/…
-
@mkulke @Xynnn007 @zvonkok and I got together to list the current state of provenance management in CoCo, gaps and next steps.
A Google doc describing the current PoC, including open questions, is…
-
## Describe
Related docs:
- Build attestations:
- Provenance attestations:
The container image built by docker buildx buildkit contains SLSA provenance in manifest list:
```json
{
"sc…
-
provenance schema link returns 404.
https://github.com/in-toto/attestation/blob/main/protos/in_toto_attestation/predicates/provenance/v1/provenance.proto#L1
![image](https://github.com/user-attachme…
-
### Summary
Hi there! I wonder if scicookie as a cookiecutter template could generate SLSA3 provenance for Python-based build artifacts (the source distribution and wheels) in the template files by d…
-
### What would you like to be added?
see for more details: https://docs.docker.com/build/attestations/
The current solution is disabling it.
- [x] https://github.com/kubernetes/kubernetes/pull/…
-
This is a tracking issue for generating SLSA provenance for OBS builds. It's a continuation of #3065.
/sig release
/area release-eng
/priority important-soon