slsa-github-generator

> Conda-forge/sqlite-feedstock; recipe/meta.yml, Aside from the cross-compilation, which is most definitely part of the process but has not yet been explored in depth[^1], nothing in your build immediately sticks out at as problematic, but i've bookmarked it for future reference during the port. The .bat build (Windows) will not change via this port. Only Unix-like environments will potentially be affected. > Is there a [multi-stage] Dockerfile to build, install and test SQLite with the new build system? Not that the sqlite project maintains, no. None of us use docker in any capacity. We work only from the canonical source tree and we like to think that it's easy enough to do that other folks can too. > Is there SLSA signing for the SQLite build artifacts? That's out of scope for, and unrelated to, this particular sub-project. > slsa-fram

Conda-forge/sqlite-feedstock; recipe/meta.yml, recipe/build.sh: https://github.com/conda-forge/sqlite-feedstock/blob/main/re... recipe/build.bat: https://github.com/conda-forge/sqlite-feedstock/blob/main/re... Is there a [multi-stage] Dockerfile to build, install and test SQLite with the new build system? Is there SLSA signing for the SQLite build artifacts? There should be a way to sign OBS Open Build Service packages with sigstore.dev's Cosign to Rekor, too IIUC. slsa-framework/slsa-github-generator: https://github.com/slsa-framework/slsa-github-generator

Team is working on a release; link[0] is the issue to follow. It looks like anyone using SLSA generators on GitHub will need to update, which is a lot of people. I suppose the tight coupling imposed by the latest wave of dependency security best practices guaranteed this would happen eventually. [0]: https://github.com/slsa-framework/slsa-github-generator/issu...

Sigstore artifact signature verification may be part of a SLSA secure software supply chain workflow. slsa-framework/slsa-github-generator > Generate [signed] provenance metadata : https://github.com/slsa-framework/slsa-github-generator#gene... : > Supply chain Levels for Software Artifacts, or SLSA (salsa), is a security framework, a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses or enterprises. > SLSA defines an incrementally-adoptable set of levels which are defined in terms of increasing compliance and assurance. SLSA levels are like a common language to talk about how secure software, supply chains and their component parts really are.