Every release: CodeQL, FOSSA, Syft SBOM, Grype scan, Cosign signatures, SLSA provenance. “Boring” here means reproducible and verifiable in a bunker. That’s the bar. That’s the point.
Every release: CodeQL, FOSSA, Syft SBOM, Grype scan, Cosign signatures, SLSA provenance. “Boring” here means reproducible and verifiable in a bunker. That’s the bar. That’s the point.