attestation
Safeguard articles tagged "attestation" — guides, analysis, and best practices for software supply chain and application security.
33 articles
Multi-Arch Image Builds and Attestation Pitfalls
Why multi-architecture container images break assumptions baked into signing, SBOM, and attestation tooling, and how to build a multi-arch pipeline that stays verifiable.
CISA Secure Software Development Attestation: What Vendors Must Know
CISA now requires software vendors selling to the US government to attest to secure development practices. Here's what the form demands and how to prepare.
AI Model Weights: Signing, Attestation, Provenance
Model weights are binaries with the privilege of code and the review of documents. Here is what signing, attestation, and provenance should actually look like.
SLSA v1.0: Software Provenance Attestation Goes Mainstream
The SLSA framework reached v1.0 in April 2023, providing a practical framework for software supply chain integrity that's already being adopted by major package registries.
CISA Secure by Design Pledge: Signatories in 2026
CISA's Secure by Design Pledge has crossed 300 signatories. Here is what the 2026 cohort is committing to, what regulators expect in return, and how to prove it.
Safeguard Gold Build Pipeline: How It Works
A walkthrough of the Gold Build pipeline that produces reproducible, attested, policy-verified container images and binaries for Safeguard customers.
Software Attestation in Practice: From Theory to Implementation
Software attestation is moving from academic concept to practical requirement. Here's how to implement it in your build pipelines today.
Trusted Computing and TPM in the Software Supply Chain
Trusted Platform Modules provide a hardware root of trust for verifying software integrity. Understanding how TPMs fit into supply chain security helps build tamper-resistant systems.
Zero-Knowledge Proofs for Supply Chain Attestation
Where zk-SNARKs, STARKs, and Bulletproofs actually fit in software supply chain attestation, and where conventional signatures remain the correct choice.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.