The signed record we didn't have in March
Two March attacks had the same shape — CI ran code it shouldn't have, with credentials it shouldn't have had, and nobody could prove what executed. That's the gap CI/lock closes.
CI/lock blog
CI/lock Blog
Latest posts
We took a real project to SLSA Level 3 in 75 minutes. This post is the build log
A real project, forked and hardened to a gated SLSA Level 3 release in about an hour, with the write-up coming out of the same session. The screenshots are timestamped from the build.