Attestation, Provenance & SLSA with Safeguard

IntermediateFree11 modules · 22 lessons

About this course

How Safeguard proves what a software artifact actually is: SLSA build levels, Sigstore keyless signing, in-toto provenance, and the SCAL/LCAL scores that turn all of it into a single number you can gate a release on.

What you'll learn

Why Attestation Matters

The Trust Problem: Code Without Proof
Attestation vs. Signing vs. Scanning

SLSA Levels & Provenance

SLSA: Supply-chain Levels for Software Artifacts
In-toto Attestation Chains
Kubernetes Admission Control on Attestation

Sigstore: Keyless Signing

Sigstore: Keyless Signing with Fulcio & Rekor
X.509 Identity and Package Signatures

SCAL & LCAL Scoring in Safeguard

SCAL: Safeguard Component Attestation Level
LCAL and Using Scores to Gate Releases

Building Toward SLSA L3, Step by Step

From No Provenance to L1: Emitting Your First Attestation
L2 and L3: Signing, Isolation, and Non-Forgeability
Sigstore in Practice: Keyless Signing and Transparency

Verification Policy and Enforcement

Writing Verification Policy That Holds
Provenance for Containers, Packages, and AI Models

Audit, Evidence, and Regulated Environments

Turning Attestation into Audit Evidence

Provenance Internals: Reading and Verifying SLSA v1

Anatomy of SLSA v1 Provenance: What a Verifier Actually Checks
DSSE Envelopes, Sigstore Bundles, and Attaching Attestations to OCI Artifacts

Build Platform Hardening

Trusted Builders: Reusable Workflows and the Provenance Generation Boundary
Source Integrity: Signed Commits, Tag Protection, and the SLSA Source Track

Attestation Beyond Provenance

SBOM and Scan-Result Attestations: Binding Evidence to the Digest
VEX and Policy-Decision Attestations: Closing the Loop

Operating a Provenance Program

Metrics, Drift, and the Compromised-Identity Playbook

01Why Attestation Matters2 lessons

The Trust Problem: Code Without Proof
Attestation vs. Signing vs. Scanning

02SLSA Levels & Provenance3 lessons

SLSA: Supply-chain Levels for Software Artifacts

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

In-toto Attestation Chains

Kubernetes Admission Control on Attestation

03Sigstore: Keyless Signing2 lessons

Sigstore: Keyless Signing with Fulcio & Rekor
X.509 Identity and Package Signatures

04SCAL & LCAL Scoring in Safeguard2 lessons

SCAL: Safeguard Component Attestation Level
LCAL and Using Scores to Gate Releases

05Building Toward SLSA L3, Step by Step3 lessons

From No Provenance to L1: Emitting Your First Attestation
L2 and L3: Signing, Isolation, and Non-Forgeability
Sigstore in Practice: Keyless Signing and Transparency

06Verification Policy and Enforcement2 lessons

Writing Verification Policy That Holds
Provenance for Containers, Packages, and AI Models

07Audit, Evidence, and Regulated Environments1 lessons

Turning Attestation into Audit Evidence

08Provenance Internals: Reading and Verifying SLSA v12 lessons

Anatomy of SLSA v1 Provenance: What a Verifier Actually Checks
DSSE Envelopes, Sigstore Bundles, and Attaching Attestations to OCI Artifacts

09Build Platform Hardening2 lessons

Trusted Builders: Reusable Workflows and the Provenance Generation Boundary
Source Integrity: Signed Commits, Tag Protection, and the SLSA Source Track

10Attestation Beyond Provenance2 lessons

SBOM and Scan-Result Attestations: Binding Evidence to the Digest
VEX and Policy-Decision Attestations: Closing the Loop

11Operating a Provenance Program1 lessons

Metrics, Drift, and the Compromised-Identity Playbook

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.