Glossary

DSSE

Dead Simple Signing Envelope

A signature format that signs an arbitrary payload together with its payload type, so a signature over one kind of document cannot be passed off as another; in-toto attestations travel in DSSE envelopes.

Defined in: DSSE protocol specification 1.0.2 (secure-systems-lab/dsse)

Covered in

Guide

Verify artifact signatures against an explicit trust policy

Require the expected artifact, signer and release context before allowing a signed package or image to proceed.

Practice: Signed artifact provenance lab: Reject a release from the wrong producer · Local project: Build and verify a signed software release