Attestation

The Attestation tab displays supply chain verification information for each component, including the Safeguard Component Attestation Level (SCAL) which indicates the trustworthiness of a component's origin and build process.

Overview

Attestation helps you understand:

• Where a component came from
• How it was built
• Whether it can be trusted
• If the build is reproducible

SCAL Levels

Safeguard Component Attestation Level (SCAL) rates components from 0-5, where lower is better:

SCAL Visual Indicators

Viewing Attestations

In Explore SBOM

1. Open a project from the Projects page
2. Navigate to Explore SBOM
3. Click the Attestation tab
4. View SCAL levels for all components

Attestation Dashboard

The Attestation tab displays:

Filtering

• By SCAL Level - Show only specific levels
• By Attestation Type - Filter by SLSA, Sigstore, etc.
• Unattested Only - Show SCAL 3-5 components
• Search - Find specific components

Attestation Details

Click on any component to view full attestation details:

Summary

Provenance Information

Signature Details

Transparency Log

Attestation Types

SLSA Provenance

Supply-chain Levels for Software Artifacts:

Sigstore

Keyless signing with:

• OIDC-based identity
• Fulcio certificates
• Rekor transparency log
• Timestamp authority

In-toto

Framework providing:

• Layout definitions
• Step attestations
• Multi-party verification
• Custom policies

Package Signatures

Traditional signatures:

• PGP/GPG signatures
• Package manager signatures
• Publisher certificates

Improving SCAL Levels

For SCAL 5 Components

1. Identify alternatives - Find similar packages with attestation
2. Contact maintainers - Request they add attestation
3. Document risk - If must use, add mitigation
4. Consider forking - Build your own attested version

For SCAL 3-4 Components

1. Check for updates - Newer versions may have attestation
2. Use Gold Directory - Find pre-verified alternatives
3. Add to watchlist - Monitor for attestation additions

For Your Own Packages

Add attestation using:

# Using Sigstore cosign
cosign sign --key cosign.key mypackage.tar.gz

# Using SLSA GitHub Action
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0

Attestation Policies

Setting Requirements

Create policies requiring maximum SCAL levels:

1. Go to Policies & Gates
2. Create new rule
3. Set maximum SCAL level
4. Choose enforcement (warn/fail)

Policy Examples

Verification Process

When Safeguard.sh analyzes a component:

1. Fetch Attestations - Download from registries, transparency logs
2. Verify Signatures - Check cryptographic validity
3. Validate Claims - Ensure claims match component
4. Check Revocation - Verify not revoked
5. Assign SCAL - Calculate attestation level

API Access

# Get attestation data for a project
curl -X GET https://api.safeguard.sh/v1/projects/{id}/attestations \
  -H "Authorization: Bearer $API_KEY"

# Get attestation details for a component
curl -X GET https://api.safeguard.sh/v1/projects/{id}/components/{component}/attestation \
  -H "Authorization: Bearer $API_KEY"

# Verify a specific attestation
curl -X POST https://api.safeguard.sh/v1/attestations/verify \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"attestation": "base64-encoded-attestation"}'

Best Practices

Monitoring

• Track SCAL distribution across projects
• Alert on new SCAL 5 components
• Review attestation trends

Selection

• Prefer SCAL 0-1 packages
• Use Gold Directory for verified components
• Document exceptions for high-SCAL packages

Compliance

• Set maximum SCAL requirements
• Include in security gates
• Report on attestation coverage

Next Steps

• Risk Score (RS)
• Security Posture
• Gold Directory