Tag
in-toto
- Jan 26, 2026 Provenance Attestations and the Trust Boundary of a Package Install What an in-toto attestation binds together, how transparency logs change the meaning of a verified install, and which attacks remain outside the model. language runtimes
- Feb 22, 2024 Provenance Statements and the Subject Digest How a build attestation names the artifact it describes, what the subject field binds, and why a valid attestation is not the same as an attestation about the image being deployed. virtualization
- Sep 9, 2022 Provenance Attestations and the Digest They Must Bind An attestation is a signed claim about a build. Its value depends on a subject digest that names the exact artifact, a predicate that names the process, and a verifier policy. security