domains / families / security / verifying-build-provenance-with-slsa-sigstore

verifying-build-provenance-with-slsa-sigstore

separate

Verifies artifact signatures and SLSA provenance using Sigstore's

When to use

• In CI/CD before deploying or promoting any container image or release binary.
• When consuming third-party artifacts (base images, Go/npm releases) that publish attestations.
• When establishing a SLSA Build L3 producer pipeline and enforcing it at the consumer side.
• During incident response to confirm whether a deployed artifact's provenance is intact.
• In admission control (e.g., Kubernetes via policy-controller / Kyverno) to admit only verified images.

Skill page

Source