GitLab

Achieve SLSA Level 2 compliance with GitLab

Nov 30, 2022Sandra Gittlen
Achieve SLSA Level 2 compliance with GitLab
SummaryAI, from the source post

This post introduces GitLab's support for SLSA Levels 1 and 2 by enabling the generation of artifact metadata directly from the GitLab Runner. By setting `RUNNER_GENERATE_ARTIFACTS_METADATA: true` in `.gitlab-ci.yml`, users can produce a `data.txt` file and an accompanying `.json` metadata file that details the build process, including input parameters, SHA hashes of the file and repository, and provenance information. This allows for the verification of artifact origin and integrity. Future plans include integrating code signing and enhancing upstream dependency validation for higher SLSA levels.

More from the Custom Compliance Frameworks trail