Attestkeep
Sign up
Supply chain

Read what was attached to an image when it was built.

Create an account Producer statements (VEX)
  1. An image arrivesIts tag is resolved to a digest.
  2. Attestationsin-toto, within the maximum age the policy sets.
  3. SBOMRecorded for each image in service.
  4. Build provenanceSLSA, from a trusted builder, at the level the policy names.
  5. VEXApplied only when signed by a signer the policy names.
  6. DecisionAdmitted or denied, with the reason.
What it does

Attestations and SBOM

Attestkeep reads the in-toto attestations attached to an image: whether one is present and within the maximum age your policy sets, whether a bill of materials is recorded for each image in service, and SLSA build provenance from a trusted builder at the level the policy names.

OpenVEX statements are applied only when they arrive as a signed attestation on the image from a signer the policy names. Anything else is recorded as seen and ignored.

How it works

Step by step.

  1. An image arrives

    Its tag is resolved to a digest.

  2. Attestations are read

    in-toto, checked against the maximum age.

  3. The SBOM is recorded

    Per image in service.

  4. Provenance is checked

    SLSA level from a trusted builder, when the policy asks.

  5. VEX is applied

    Only from a signer the policy names.

What it records

The supply chain section counts attestations, SBOMs and verified provenance per image; producer statements have a section of their own.

Producer statements (VEX)Policies

42 clauses across 11 frameworks cite at least one of these statements.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account