Build provenance and supply-chain levels.

Signed attestations of how and where artefacts were built, graded by level.

Standards

  • SLSA v1.0
  • in-toto attestation framework

OT security and software supply chain