slsa-verifier is a command-line utility for verifying the provenance of software artifacts produced by supported build systems. It implements checks based on the Supply-chain Levels for Software Artifacts (SLSA) framework, which defines practices for improving the integrity and security of software development and distribution.
Software provenance describes how an artifact was produced, including its source repository, build environment and the system responsible for creating it. slsa-verifier checks cryptographic signatures associated with provenance attestations and compares the recorded information against expected values supplied by the user. This helps determine whether a downloaded binary, container image or package originated from an authorised build process. The tool supports provenance produced by SLSA GitHub generators and Google Cloud Build, and can be incorporated into automated workflows that verify software before distribution or deployment.
This is free and open source software.
Key Features
- Verify SLSA provenance associated with software artifacts.
- Check cryptographic signatures on provenance attestations.
- Validate the identity of the builder responsible for producing an artifact.
- Confirm that artifacts originate from an expected source repository.
- Check source branches, release tags and versioned tags.
- Validate selected GitHub Actions workflow inputs.
- Verify provenance for multiple artifacts covered by the same attestation.
- Support verification of container images referenced by immutable digests.
- Experimental verification of npm package provenance.
- Verify supported Verification Summary Attestations.
- Inspect verified provenance by printing the underlying in-toto statement.
- Integrate provenance verification into automated CI/CD workflows.
- Cross-platform support – runs on Linux, macOS, and Windows.
Website: github.com/slsa-framework/slsa-verifier
Support:
Developer: SLSA Framework contributors
License: Apache License 2.0
slsa-verifier is written in Go. Learn Go with our recommended free books and free tutorials.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.