Skip to content

README.md

Latest commit

 

History

History
47 lines (34 loc) · 1.38 KB

README.md

File metadata and controls

47 lines (34 loc) · 1.38 KB

slsa_builder

SLSA Level 3 public key store and artifact verification wrapper.

Overview

This repository is the primary trust root for the public key used to verify SLSA Level 3 provenance attestations. Verification is performed with Cosign using the verify-blob-attestation command against the key stored in this repo.

Repository Layout

keys/
  activesalsa.pub     Trusted PEM-encoded public key for SLSA provenance verification

Prerequisites

Verification

To validate that an artifact's DSSE-envelope attestation was signed by the trusted builder key:

cosign verify-blob-attestation \
      --insecure-ignore-tlog \
      --key keys/activesalsa.pub \
      --signature "$dsse_name" \
      --type "https://slsa.dev/provenance/v1" \
      "$artifact_name"
Flag Purpose
--insecure-ignore-tlog Skip transparency-log lookup (key-based trust only)
--key Path to the trusted public key (keys/activesalsa.pub)
--signature Path to the DSSE-envelope file for the artifact
--type Expected SLSA provenance predicate type

A zero exit code means the attestation signature is valid and the provenance type matches — confirming SLSA Level 3 provenance for the artifact.