Signed releases and SBOMs. Checksums are signed with keyless cosign, identifying the workflow, repository and tag that produced them. Every archive ships an SPDX SBOM.
Signed releases and SBOMs. Checksums are signed with keyless cosign, identifying the workflow, repository and tag that produced them. Every archive ships an SPDX SBOM.