#slsa
Tagged “slsa”
3 articlesSecurity & supply chain
Packer 1.16 ships signed SLSA provenance, and a command to check it
Packer v1.16.0 emits signed SLSA Provenance v1 attestations for every machine image it builds, and adds a verify-attestation command so downstream pipelines can actually check the signature before promoting an AMI or a VM template.
Aug 14, 2026 · Tomás VegaSecurity & supply chainThe npm worm that shipped with valid SLSA provenance
A DevOps.com analysis of the Miasma npm worm makes an uncomfortable case: signing and provenance told the honest truth, and the pipeline still shipped malware. When the build platform itself is the attack surface, a green attestation is a description of the failure, not a defence against it.
Jul 22, 2026 · Tomás VegaSecurity & supply chainSBOM attestation is becoming a default pipeline step
Generating and signing a software bill of materials at build time is shifting from compliance nice-to-have to standard CD hygiene. Here's the minimal viable setup.
Jun 12, 2026 · Tomás Vega