slsa-verifier for Mac

Verification of SLSA provenance This project is no longer actively maintained. We are working on guidance and simpler tooling to replace it. If you are verifying attestations for GitHub Actions, we suggest generating them with GitHub artifact attestations, a built-in solution for generating SLSA provenance on GitHub, and verifying them with gh attestation verify. Overview What is SLSA? What is provenance? What is slsa-verifier? Installation Compilation from source Option 1: Install via go Option 2: Compile manually Use the installer Action on GitHub Actions Download the binary Use Homebrew on macOS Available options Option list Option details Verification for GitHub builders Artifacts Containers The verify-image command npm packages The verify-npm-package command npm packages built using the SLSA3 Node.js builder npm packages built using the npm CLI Container-based builds Verification for GitHub attest-build-provenance Attestations Verification for Google Cloud Build Artifacts Containers Verification Summary Attestations (VSA) Caveats Sigstore Subject Resource Descriptors Known Issues tuf: invalid key panic: assignment to entry in nil map Technical design Blog post Specifications TOCTOU attacks

Overview

What is SLSA?

Supply chain Levels for Software Artifacts, or SLSA (salsa), is a security framework, a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses or enterprises.

SLSA defines an incrementially adoptable set of levels which are defined in terms of increasing compliance and assurance. SLSA levels are like a common language to talk about how secure software, supply chains and their component parts really are.

What is provenance?

Provenance is information, or metadata, about how a software artifact was created. This could include information about what source code, build system, and build steps were used, as well as who and why the build was initiated. Provenance can be used to determine the authenticity and trustworthiness of software artifacts that you use.

As part of the framework, SLSA defines a provenance format which can be used hold this metadata.

What is slsa-verifier?

slsa-verifier is a tool for verifying SLSA provenance that was generated by CI/CD builders. slsa-verifier verifies the provenance by verifying the cryptographic signatures on provenance to make sure it was created by the expected builder. It then verifies that various values such as the builder id, source code repository, ref (branch or tag) matches the expected values.

It currently supports verifying provenance generated by: SLSA generator Google Cloud Build (GCB).

Installation

You have two options to install the verifier.

Compilation from source

Option 1: Install via go

If you want to install the verifier, you can run the following command: