From bb5ec47ec0580da1e29798de5e22042b119eed66 Mon Sep 17 00:00:00 2001 From: Scott Gress Date: Fri, 17 Jan 2025 15:38:37 +0000 Subject: [PATCH] Add SLSA guide (#25423) This PR adds an article about the software attestations Fleet now adds to release artifacts. --------- Co-authored-by: Drew Baker <89049099+Drew-P-drawers@users.noreply.github.com> --- articles/fleet-software-attestation.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 articles/fleet-software-attestation.md diff --git a/articles/fleet-software-attestation.md b/articles/fleet-software-attestation.md new file mode 100644 index 0000000000..d306118bf5 --- /dev/null +++ b/articles/fleet-software-attestation.md @@ -0,0 +1,17 @@ +# Fleet software attestation + +At Fleet, we understand the importance of having a secure software supply chain. Our core value of 🟣 [Openness](https://fleetdm.com/handbook/company#openness) extends to ensuring that our users can verify the provenance and authenticity of any Fleet software they install. With that in mind, as of version 4.63.0 Fleet we will be adding [SLSA attestations](https://slsa.dev/) to our released binaries and container images. This includes the Fleet and Fleetctl server software, the Orbit and Fleet Desktop software for hosts, and the osqueryd updates periodically downloaded by hosts. + +## What is software attestation? + +A software attestation is a cryptographically-signed statement provided by a software creator that certifies the build process and provenance of one or more software _artifacts_ (which might be files, container images, or other outputs). In other words, it's a promise to our users that the software we're providing was built by us, using a process that they can trust and verify. We utilize the SLSA framework for attestations which you can read more about [here](https://slsa.dev/). After each release, attestations are added to https://github.com/fleetdm/fleet/attestations. + +## Verifying our release artifacts + +Any product of a Fleet release can be _verified_ to prove that it was indeed created by Fleet, using the `gh` command line tool from Github. See the [`gh attestation verify`](https://cli.github.com/manual/gh_attestation_verify) docs for more info. + + + + + +