
11/30/2022 · Sandra Gittlen
What this post added
This post introduces GitLab's support for SLSA Levels 1 and 2 by enabling the generation of artifact metadata directly from the GitLab Runner. By setting `RUNNER_GENERATE_ARTIFACTS_METADATA: true` in `.gitlab-ci.yml`, users can produce a `data.txt` file and an accompanying `.json` metadata file that details the build process, including input parameters, SHA hashes of the file and repository, and provenance information. This allows for the verification of artifact origin and integrity. Future plans include integrating code signing and enhancing upstream dependency validation for higher SLSA levels.