Attestation

6 items tagged with "attestation"

Filter by type:

Standards1

AICPA SOC 2 (Trust Services Criteria 2017, rev. 2022)

Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy) underpinning SOC 2 Type I/II attestations.

Best Practices1

Best Practice

in-toto Supply Chain Attestation

A framework that secures the software supply chain by cryptographically verifying that each step in the build and release process was performed as intended.

FAQs1

FAQ

How do I prove an SBOM from Vibgrate is authentic?

In Vibgrate Cloud, the SBOM Hub can export your SBOM wrapped in a signed attestation — an in-toto Statement in a DSSE envelope whose subject is the SB...

Glossaries3

Glossary

Attestation

An attestation is a signed, machine-readable statement about a software artifact — such as how it was built or what it contains — that a consumer can cryptographically verify.

Glossary

Provenance

Provenance is verifiable metadata that records where a software artifact came from and how it was built — its source, build system, and inputs — so consumers can trace and trust it.

Glossary

DSSE (Dead Simple Signing Envelope)

DSSE is a standard format for wrapping a payload together with its signature so the signed content and its type are bound and tamper-evident.