Attestation
Signed evidence about a subject that a verifier can check. In the software supply chain it is a signed statement bound to an artifact’s digest, such as SLSA provenance or a test result, usually in the in-toto format; device attestation shows that a key lives in genuine hardware, and a supplier’s attestation form is a signed self-declaration.
Covered in
Answer a US federal secure software attestation request in 2026: the CISA form, its SSDF mapping and the evidence behind each statement
Know what is and isn't required after OMB M-26-05, then answer an agency's request statement by statement, with the SSDF tasks the form maps and release evidence for each claim.
Verify artifact signatures against an explicit trust policy
Require the expected artifact, signer and release context before allowing a signed package or image to proceed.
Read SLSA provenance and verify the claim you need
Connect an artifact to its build evidence while distinguishing provenance, build assurance and source controls.
Apply NIST SSDF (SP 800-218) to one product: practices, evidence and attestation in 2026
Connect secure-development practices to an actual product’s work, artifacts and responsibilities instead of a questionnaire full of unsupported yes answers.
Protect package publication and the update channel
Constrain release identities, verify what consumers receive, and prepare for publisher or update-key compromise.
Place each security control in the pipeline and decide what it blocks
Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.
All 10 pages that cover Attestation in the library
Practice: Signed artifact provenance lab: Reject a release from the wrong producer · Local project: Build and verify a signed software release · Local project: Repair a security pipeline for GitHub Actions and GitLab CI