Tag archive
After SBOM and Cosign comes Provenance. Issue SLSA Build L3 provenance with slsa-github-generator and verify it with slsa-verifier, end to end on real machines.
A complete teardown of the SLSA specification. We dissect the threat model, Build and Source track requirements, Provenance structure, and the verification flow with diagrams.
In Q3 2025, our team audited 112 GitHub repositories across 8 product lines and found 94% had no...
EnvSecOps = verifying the bag: only policy-approved tooling, cryptographically attested, then short-lived access. It’s not radical. It’s obvious.
Recently, Flutter, Google's popular open-source UI software development toolkit, announced its new compliance with the SLSA Level 1.