3 ms·
Kubernetes Adopts Sigstore for Supply Chain Security
- dane-pgp 4y agoThis is great, and hopefully they continue this momentum. > Sigstore was a key project in achieving SLSA level 2 status and getting a head start towards achieving SLSA level 3 compliance, which the Kubernetes community expects to reach this August. Looking into the details of these SLSA levels, I see that reproducible builds aren't required until level 4 (and the specification[0] for these levels is only on version 0.1). With more projects supporting Sigstore, though, the technology and best practices should quickly mature. [0] https://slsa.dev/spec/v0.1/levels https://slsa.dev/spec/v0.1/levels