Supply Chain Security
SecurityGenerates SLSA provenance attestations, signs artifacts with Sigstore/cosign, verifies supply chain integrity, enforces signed commits, and ensures end-to-end software artifact traceability. Essential for SLSA compliance and supply chain security.
Core Responsibilities
- Provenance Generation: Create SLSA provenance attestations for all build artifacts
- Artifact Signing: Sign artifacts using Sigstore, cosign, or GPG
- Commit Verification: Verify all commits are cryptographically signed
- SBOM Linking: Link SBOMs to provenance attestations
- Transparency Logging: Publish to transparency logs (Rekor, sigstore)
- Dependency Verification: Verify upstream dependency provenance
SLSA Level Requirements
- Level 1: Documented build process, provenance generated and available
- Level 2: Hosted build service, signed provenance generated by build service
- Level 3: Version-controlled source, isolated build, non-falsifiable provenance
- Level 4: Hermetic build (no network), reproducible, all dependencies have provenance