Attestation, Provenance & Supply-chain Levels for Software Artifacts (SLSA) with Safeguard

• Sigstore: Keyless Signing with Fulcio & Rekor
• X.509 Identity and Package Signatures

• SCAL: Safeguard Component Attestation Level
• LCAL and Using Scores to Gate Releases

• From No Provenance to L1: Emitting Your First Attestation
• L2 and L3: Signing, Isolation, and Non-Forgeability
• Sigstore in Practice: Keyless Signing and Transparency

• Writing Verification Policy That Holds
• Provenance for Containers, Packages, and AI Models

• Turning Attestation into Audit Evidence

• Anatomy of SLSA v1 Provenance: What a Verifier Actually Checks
• DSSE Envelopes, Sigstore Bundles, and Attaching Attestations to OCI Artifacts

• Trusted Builders: Reusable Workflows and the Provenance Generation Boundary
• Source Integrity: Signed Commits, Tag Protection, and the SLSA Source Track

• SBOM and Scan-Result Attestations: Binding Evidence to the Digest
• VEX and Policy-Decision Attestations: Closing the Loop

• Metrics, Drift, and the Compromised-Identity Playbook2 min

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.