Sigstore artifact signature verification may be part of a SLSA secure software supply chain workflow. slsa-framework/slsa-github-generator > Generate [signed]

Sigstore artifact signature verification may be part of a SLSA secure software supply chain workflow. slsa-framework/slsa-github-generator > Generate [signed] provenance metadata : https://github.com/slsa-framework/slsa-github-generator#generate-provenance https://github.com/slsa-framework/slsa-github-generator#gene... : > Supply chain Levels for Software Artifacts, or SLSA (salsa), is a security framework, a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses or enterprises. > SLSA defines an incrementally-adoptable set of levels which are defined in terms of increasing compliance and assurance. SLSA levels are like a common language to talk about how secure software, supply chains and their component parts really are.