S

slsa

The conformance contract for projects under gitlab-com/public-sector.

Consumer workload: a container image. Adoption phase cutover, so the regulatory baseline blocks an unsigned image. The red pipeline is deliberate: the gap is planted so a reader can watch the gate stop it.

A curated kaniko for GitLab Runner. Seven signed image variants per release on UBI9, including a FIPS-strict path for GODEBUG=fips140=only environments.

Harness Software Supply Chain CI/CD components for GitLab. SBOM, SLSA, Artifact Signing, and Policy Enforcement