Signing and Provenance: Sigstore, Artifact Attestations and SLSA v1.2
An image signature proves the content has not changed and who signed it, and provenance proves which repo, workflow and commit produced it; both only help if they are verified at deploy time. We verify keyless Sigstore signatures and GitHub attestations on real releases, bind an SBOM attestation to the Bookstore image, reject unsigned and tag-referenced images with Kyverno, and assess the pipeline against SLSA v1.2.
14 Nov 2026
·
11 min
·
5
