New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature request: Please sign your releases #3001

Open

udf2457 opened this issue Apr 20, 2024 · 2 comments

udf2457 commented Apr 20, 2024

It is easier than ever to do in 2024! You can even do it fully-automated via Github Actions, Github OIDC and Sigstore "keyless" signing.

Author

udf2457 commented Apr 23, 2024

Useful references:
https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#provenance-for-goreleaser
https://goreleaser.com/blog/slsa-generation-for-your-artifacts/#slsa-github-generator

Contributor

jpds commented May 25, 2024

The Git tags now appear to be signed - so I think this can be closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment