Tag
transparency-logs
- Jan 26, 2026 Provenance Attestations and the Trust Boundary of a Package Install What an in-toto attestation binds together, how transparency logs change the meaning of a verified install, and which attacks remain outside the model. language runtimes
- Feb 22, 2025 Artifact Provenance from Commit to Deployed Digest Signed attestations bind an artifact digest to the materials and builder that produced it. What the statement must contain, how it is verified, and which attacks it does not stop. devops
- Jan 24, 2023 Keyless Signing and Transparency Logs for Build Artifacts Short-lived certificates bound to an OIDC identity remove long-lived keys from the signing path, and an append-only log makes a signature public evidence rather than a private promise. security