Upstream the SLSA attestation verification support currently carried as a patch in pulp-service (pulp/pulp-service#977).
SLSA attestations that lack a Sigstore certificate can be verified against a public key configured via ATTESTATION_VERIFICATION_KEY. This enables verification of attestations from build systems that use their own signing keys instead of Sigstore.
Upstream the SLSA attestation verification support currently carried as a patch in pulp-service (pulp/pulp-service#977).
SLSA attestations that lack a Sigstore certificate can be verified against a public key configured via
ATTESTATION_VERIFICATION_KEY. This enables verification of attestations from build systems that use their own signing keys instead of Sigstore.