CI status, signature and provenance verification

CI status, signature and provenance verification An architecture diagram generated by Archify. CI execution · TaskRun / PipelineRun · Build stage CI execution TaskRun / PipelineRun Chains controller · async after run completion · Tekton Chains (automatic) Chains controller async after run completion Sign OCI image · Task output / KMS · Tekton Chains (automatic) Sign OCI image Task output / KMS Provenance / Attestation · Pipeline / SLSA v1.0 · Tekton Chains (automatic) Provenance / Attestation Pipeline / SLSA v1.0 OCI signature storage · Amazon ECR · Tekton Chains (automatic) OCI signature storage Amazon ECR CI + signature checks · success / trusted key · Verification stage (deploy time) CI + signature checks success / trusted key Provenance policy · builder / source / digest · Verification stage (deploy time) Provenance policy builder / source / digest Admission Control · promotion / admission policy · Verification stage (deploy time) Admission Control promotion / admission policy completion hook record signature record attestation fetch signatures/provenance allow / deny Build stage Tekton Chains (automatic) Verification stage (deploy time) Legend Backend Security External