[{"data":1,"prerenderedAt":178},["ShallowReactive",2],{"term-a\u002Fattestation":3,"related-a\u002Fattestation":161},{"id":4,"title":5,"acronym":6,"body":7,"category":142,"description":143,"difficulty":144,"extension":145,"letter":146,"meta":147,"navigation":93,"path":148,"related":149,"seo":155,"sitemap":156,"stem":159,"subcategory":6,"__hash__":160},"terms\u002Fterms\u002Fa\u002Fattestation.md","Attestation",null,{"type":8,"value":9,"toc":136},"minimark",[10,15,19,23,26,30,125,129,132],[11,12,14],"h2",{"id":13},"eli5-the-vibe-check","ELI5 - The Vibe Check",[16,17,18],"p",{},"Think of attestation as a build getting a notarized receipt: it doesn't just claim to be trustworthy, it comes with cryptographically signed proof of exactly what source, dependencies, and build steps went into it. It's like a chef signing off a dish with the recipe and the grocery receipt stapled to the plate, so nobody can quietly swap an ingredient later without you noticing.",[11,20,22],{"id":21},"real-talk","Real Talk",[16,24,25],{},"An attestation is a signed, machine-readable statement about a software artifact, typically capturing metadata such as the source repository, build environment, and dependencies used to produce it. Standards like in-toto and SLSA define attestation formats so consumers can verify how and where an artifact was built before trusting it.",[11,27,29],{"id":28},"show-me-the-code","Show Me The Code",[31,32,37],"pre",{"className":33,"code":34,"language":35,"meta":36,"style":36},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Attach a signed attestation to a container image\ncosign attest --predicate provenance.json --type slsaprovenance \\\n  --key cosign.key myregistry.io\u002Fapp:1.4.0\n\n# Verify it before deploying\ncosign verify-attestation --type slsaprovenance \\\n  --key cosign.pub myregistry.io\u002Fapp:1.4.0\n","bash","",[38,39,40,49,76,88,95,101,115],"code",{"__ignoreMap":36},[41,42,45],"span",{"class":43,"line":44},"line",1,[41,46,48],{"class":47},"sHwdD","# Attach a signed attestation to a container image\n",[41,50,52,56,60,63,66,69,72],{"class":43,"line":51},2,[41,53,55],{"class":54},"sBMFI","cosign",[41,57,59],{"class":58},"sfazB"," attest",[41,61,62],{"class":58}," --predicate",[41,64,65],{"class":58}," provenance.json",[41,67,68],{"class":58}," --type",[41,70,71],{"class":58}," slsaprovenance",[41,73,75],{"class":74},"sTEyZ"," \\\n",[41,77,79,82,85],{"class":43,"line":78},3,[41,80,81],{"class":58},"  --key",[41,83,84],{"class":58}," cosign.key",[41,86,87],{"class":58}," myregistry.io\u002Fapp:1.4.0\n",[41,89,91],{"class":43,"line":90},4,[41,92,94],{"emptyLinePlaceholder":93},true,"\n",[41,96,98],{"class":43,"line":97},5,[41,99,100],{"class":47},"# Verify it before deploying\n",[41,102,104,106,109,111,113],{"class":43,"line":103},6,[41,105,55],{"class":54},[41,107,108],{"class":58}," verify-attestation",[41,110,68],{"class":58},[41,112,71],{"class":58},[41,114,75],{"class":74},[41,116,118,120,123],{"class":43,"line":117},7,[41,119,81],{"class":58},[41,121,122],{"class":58}," cosign.pub",[41,124,87],{"class":58},[11,126,128],{"id":127},"when-youll-hear-this","When You'll Hear This",[16,130,131],{},"\"The pipeline generates an attestation for every image before it's allowed into the registry.\" \u002F \"Our supply chain policy rejects any artifact that doesn't ship a valid attestation.\"",[133,134,135],"style",{},"html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":36,"searchDepth":51,"depth":51,"links":137},[138,139,140,141],{"id":13,"depth":51,"text":14},{"id":21,"depth":51,"text":22},{"id":28,"depth":51,"text":29},{"id":127,"depth":51,"text":128},"security","Think of attestation as a build getting a notarized receipt: it doesn't just claim to be trustworthy, it comes with cryptographically signed proof of exact...","advanced","md","a",{},"\u002Fterms\u002Fa\u002Fattestation",[150,151,152,153,154],"SLSA","SBOM","Sigstore","Cosign","Supply Chain Security",{"title":5,"description":143},{"changefreq":157,"priority":158},"weekly",0.7,"terms\u002Fa\u002Fattestation","gb39MLkyOkvMiIHTJJ55kf016YMizSYUSOIB07VN1qA",[162,165,169,172,175],{"title":153,"path":163,"acronym":6,"category":142,"difficulty":144,"description":164},"\u002Fterms\u002Fc\u002Fcosign","Cosign is the tool for signing container images, SBOMs, and other artifacts. It's part of the Sigstore project and makes image signing as easy as 'cosign s",{"title":151,"path":166,"acronym":151,"category":142,"difficulty":167,"description":168},"\u002Fterms\u002Fs\u002Fsbom","intermediate","An SBOM (Software Bill of Materials) is a complete ingredient list for your software — every library, framework, and dependency with their exact versions.",{"title":152,"path":170,"acronym":6,"category":142,"difficulty":144,"description":171},"\u002Fterms\u002Fs\u002Fsigstore","Sigstore makes signing software as easy as logging in with your Google account. No managing PGP keys, no key rotation headaches.",{"title":150,"path":173,"acronym":6,"category":142,"difficulty":144,"description":174},"\u002Fterms\u002Fs\u002Fslsa","SLSA (pronounced 'salsa') is a framework with levels (1-4) that measure how secure your software supply chain is. Level 1: you have some build process.",{"title":154,"path":176,"acronym":6,"category":142,"difficulty":167,"description":177},"\u002Fterms\u002Fs\u002Fsupply-chain-security","Supply Chain Security protects the entire path from code to production — dependencies, build systems, registries, everything.",1792528061846]