> - Run your build on a hosted platform that generates and signs provenance
> - Publish the provenance to allow downstream users to verify
> [...]
> SLSA 3
> To achieve SLSA 3, you must:
> - Run your build on a hosted platform that generates and signs provenance
> - Ensure that build runs cannot influence each other
> - Produce signed provenance that can be verified as authentic
And:
> For now, the convention is to keep the provenance attestation with your artifact. Though Sigstore is becoming more and more popular, the format of the provenance is currently tool-specific.
> aqua installs tools securely. aqua supports Checksum Verification, Policy as Code, Cosign and SLSA Provenance, GitHub Artifact Attestations, and Minisign. Please see Security.
dist author here. since darren0 was so kind to reference my tool, I'll just add dist is written in go, is cross platform, can handle github, gitlab, homebrew packages (with caveats), and a few others and you can create custom aliases as well. there are a few additional features in the works right now. also supports signature and checksum verification if available.
It's great to see movement in this space. The main problem in my experience is github api and throttling. It's really hard to download 40 binaries while building an image for CI/CD. Binaries themselves are CDNed, but github apis to find them are easily throttled, especially behind NAT.
Need to have some caching mechanism avoid this. Eget seems currently abandoned, maybe gah can start looking stuff in a cache.
cool. please let me know when you post, I would like to read. I'm the author of dist if that wasn't clear. Also looking for feedback on the project should you find it useful.
Now this thread is revealing an abundance of alternate tools.
I'm considering creating a "list of fetching tools" just to help folks find the one they want, since some features described here are very interesting.
Fetchy is really nice! I really like the how smooth it looks in demo. Only thing that I don't like is the manifest file. Personally, I would be too lazy to create one. But I find use case for it for organizations, when you want to keep it as a code in repo, which pre-defined versions for whole organization. If, for example, you would be able to tell fetchy to use remote manifest that would be a game changer for organizations.
eget was developed by the same person like the micro terminal text editor.