Evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Example goreleaser + github actions config with keyless signing, SBOM generation, and attestations

Example project using SLSA 3 Generic Generator with GoReleaser

Sign and package attestations in sigstore bundles

A Jenkins plugin to create SLSA provenance attestations

Generates SBOMs remotely in a verifiable manner (SLSA Build L3)

Create SLSA Provenance from nix flake

Buildkite plugin that generates a SLSA Provenance attestation for a build step

Ensignia Provenance Upload Action

Jenkins Shared Library

SLSA generate and verify provenance demo

A Github Actions pipeline that builds safer containers

🔒 Fail CI if dependencies in your lockfile lose npm provenance or trusted publisher status, enhancing the security of your projects.