Language-agnostic SLSA provenance generation for Github Actions

Chainloop is an Open Source evidence store for your Software Supply Chain attestations, SBOMs, VEX, SARIF, CSAF files, QA reports, and more.

Template Go app repo with local test/lint/build/vulnerability check workflow, and on tag image test/build/release pipelines, with ko generative SBOM, cosign attestation, and SLSA build provenance

Developer-centric tool to secure your software supply chain.

A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.

Github Action implementation of SLSA Provenance Generation

Container image provenance spec that allows tracing CVEs detected in registry images back to a CVE's source of origin.

Stream, Mutate and Sign Images with AWS Lambda and ECR

SLSA level 3 action

Mattermost builder

Google Container Analysis data import utility, supports OSS vulnerability scanner reports, SLSA provenance and sigstore attestations.

A demonstration of showing how to use 💃SLSA 3 Generic Generator with GoReleaser to release artifacts while generating signed SLSA provenance

Define a reproducible Go build.

Sample Go application project with supply chain security workflows conforms to the SLSA Build Level 3 specification

A demonstration of how GoReleaser can help us to make software supply chain more secure by using bunch of tools such as cosign, syft, grype, slsa-provenance

Library to create, verify, and evaluate policy for attestations on container images

A proof-of-concept SLSA provenance generator for Buildkite.

Really Simple Service Registry

Ensignia Provenance Upload Action