The safeguards map / 3.7 Admission and owner settings
SLSA Verifier
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A command line tool that verifies SLSA provenance produced by CI/CD builders before an artifact is used.
Where it sits
3.7 Admission and owner settings (primary): Verifies the signatures on an artifact's SLSA provenance and checks that the builder, source repository and tag match what the owner expects, before the artifact is used.
slsa-verifier is a tool for verifying [SLSA provenance](https://slsa.dev/provenance/) that was generated by CI/CD builders.
captured
slsa-verifier verifies the provenance by verifying the cryptographic signatures on provenance to make sure it was created by the expected builder.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who run it
- Runs
- by hand
- Policy comes from
- owner-entered settings
Handoffs
consumes Provenance and signatures: SLSA provenance
Collector's note
The README says the project is no longer actively maintained and points to GitHub artifact attestations instead. The TAC project table lists SLSA, the specification, not this verifier, so it has no foundation home here.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.