GitLab

Securing the software supply chain through automated attestation

Aug 10, 2022Sandra Gittlen
Securing the software supply chain through automated attestation
SummaryAI, from the source post

Introduced automated compliance attestation in Release 15.1. GitLab Runner can generate and produce attestation metadata for all build artifacts by setting the RUNNER_GENERATE_ARTIFACTS_METADATA environment variable to "true". The metadata is rendered in a plain text .json file stored with the artifact. This feature aims to automate the previously manual and error-prone attestation process, providing build integrity guarantees and protecting against software tampering.

More from the FIPS Package Dependency Management trail