Tag
signing
- Feb 22, 2025 Artifact Provenance from Commit to Deployed Digest Signed attestations bind an artifact digest to the materials and builder that produced it. What the statement must contain, how it is verified, and which attacks it does not stop. devops
- Sep 9, 2022 Provenance Attestations and the Digest They Must Bind An attestation is a signed claim about a build. Its value depends on a subject digest that names the exact artifact, a predicate that names the process, and a verifier policy. security