Open-source alternatives to Slsa

Deploy-time Policy Enforcer for Kubernetes applications

in-toto Attestation Framework

Overlay

Cosign is a tool for signing and verifying software artifacts, primarily those stored in OCI-compatible registries such as container images, Helm charts, SBOMs, and Tekton bundles. It supports keyless signing using ephemeral keys and short-lived certificates from the Sigstore public-good infrastructure, associating signatures with an OpenID Connect identity rather than a long-lived cryptographic key. The project provides multiple signing and verification methods, including private keys, key pairs stored in KMS providers like AWS KMS and Azure Key Vault, and hardware security keys. It can sign

Sigstore OIDC PKI

Software Supply Chain Transparency Log

preflight helps you verify scripts and executables to mitigate chain of supply attacks such as the recent Codecov hack.

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

Supply Chain Security in Tekton Pipelines