Read all about here :)
slsa.dev/blog/2025/10...

Then, we verify the #SBOM, a vulnerability scan, and apply signed #VEX documents to suppress any non-exploitable CVEs.

To round it all up, AMPEL issues a VSA for end-user consumption that ships with each artifact, showing how to verify the released binaries.

This time, the demo is a full SLSA end-to-end example. The post demonstrates how to leverage AMPEL to verify SLSA Build Track #attestations for the security level of a commit, check the provenance attestation of a builder image, and generate a VSA with the results, protecting the build process.

We would love to hear your thoughts and feedback, but only after celebrating with a couple of beers, cheers! 🍻

Shout out to @odd.computer for all their work securing open source and helping us operationalize OSS Rebuild with AMPEL 🤗

AMPEL is Carbiner's flagship project, and to mark the release cut, we've published a PolicySet example and full demo/tutorial to protect projects from the recent npm credentials compromise with the help of Google's OSS Rebuild project. Check it out here:

github.com/carabiner-de...