Attestation

ELI5 - The Vibe Check

Think of attestation as a build getting a notarized receipt: it doesn't just claim to be trustworthy, it comes with cryptographically signed proof of exactly what source, dependencies, and build steps went into it. It's like a chef signing off a dish with the recipe and the grocery receipt stapled to the plate, so nobody can quietly swap an ingredient later without you noticing.

Real Talk

An attestation is a signed, machine-readable statement about a software artifact, typically capturing metadata such as the source repository, build environment, and dependencies used to produce it. Standards like in-toto and SLSA define attestation formats so consumers can verify how and where an artifact was built before trusting it.

Show Me The Code

# Attach a signed attestation to a container image
cosign attest --predicate provenance.json --type slsaprovenance \
  --key cosign.key myregistry.io/app:1.4.0

# Verify it before deploying
cosign verify-attestation --type slsaprovenance \
  --key cosign.pub myregistry.io/app:1.4.0

When You'll Hear This

"The pipeline generates an attestation for every image before it's allowed into the registry." / "Our supply chain policy rejects any artifact that doesn't ship a valid attestation."