CosignSigstore
Open sourceSigstore CLI for signing and verifying container images and artifacts and attaching attestations to registries.
Secure Software Supply Chain Attestation Tools (SLSA/Provenance)
Ranking methodology
In development — no version effective yet.
Decision archetype: physical ops · Scores are category-relative (P-01) and commercial relationships never affect rank (P-04).
Tools (3)
SLSA GitHub GeneratorSLSA Project
Open sourceReusable GitHub Actions that automatically produce signed SLSA provenance attestations for build artifacts.
in-totoCNCF
Open sourceOpen source framework for protecting software supply chain integrity through attestations.