Custom Compliance Frameworks
Achieve SLSA Level 2 compliance with GitLab

Achieve SLSA Level 2 compliance with GitLab

11/30/2022 · Sandra Gittlen

What this post added

This post introduces GitLab's support for SLSA Levels 1 and 2 by enabling the generation of artifact metadata directly from the GitLab Runner. By setting `RUNNER_GENERATE_ARTIFACTS_METADATA: true` in `.gitlab-ci.yml`, users can produce a `data.txt` file and an accompanying `.json` metadata file that details the build process, including input parameters, SHA hashes of the file and repository, and provenance information. This allows for the verification of artifact origin and integrity. Future plans include integrating code signing and enhancing upstream dependency validation for higher SLSA levels.

Read the original post ↗