Posts Tagged ‘slsa’
TL;DR Supply-chain Levels for Software Artifacts (SLSA) attestations are a great way to show that you care about security, and they’re fairly trivial to add to delivery pipelines that produce a single binary or container image. But things get tricky with matrix jobs that build lots of things in parallel, as you then need to […]
Filed under: Dart, Docker, Gemini, howto | Leave a Comment
Tags: AI, ARM, artifact, attestation, CD, container, Cosign, Dart, DevOps, Docker, Gemini, GitHub Actions, image, json, matrix, security, signing, slsa
What? Let’s get the terminology cleared up. This post is about: Software Bill of Materials (SBOM) – the idea that you write down what’s inside the software you’re shipping (in a standarised form) so that people can figure out what vulnerabilities might be in there and make risk decisions based on that insight. Supply-chain Levels […]
Filed under: security | 3 Comments
Tags: OpenSSF, sbom, scorecard, security, slsa, supply chain
