@@ -97,6 +97,7 @@ tags, and then generate with `hack/update-toc.sh`.
97
97
- [ SLSA Level 2: Tamper Resistance of the Build Service] ( #slsa-level-2-tamper-resistance-of-the-build-service )
98
98
- [ SLSA Level 3: Extra Resistance to Specific Threats] ( #slsa-level-3-extra-resistance-to-specific-threats )
99
99
- [ SLSA Level 4: Highest Levels of Confidence and Trust] ( #slsa-level-4-highest-levels-of-confidence-and-trust )
100
+ - [ Implementation History] ( #implementation-history )
100
101
<!-- /toc -->
101
102
102
103
## Release Signoff Checklist
@@ -151,8 +152,8 @@ is a framework to harden software supply currently being defined by the
151
152
Group] ( https://github.com/ossf/wg-digital-identity-attestation ) .
152
153
153
154
The framework provides requirements and recommendations to software
154
- build systems to harden the environments and processes that drive them.
155
- It also defines the metadata that needs to be produced to trace the
155
+ build systems to harden their environments and the processes that drive
156
+ them. It also defines the metadata that needs to be produced to trace the
156
157
origins of every item in a software release.
157
158
158
159
The main goal of this enhancement is to provide downstream consumers of our
@@ -184,6 +185,8 @@ updates.
184
185
185
186
## Motivation
186
187
188
+ Release Kubernetes in a zero-trust environment.
189
+
187
190
Kubernetes releases represent key links in many software supply chains, not
188
191
just for the project itself but also for consumers that derive, repackage and
189
192
distribute our artifacts downstream. The project releases end-user artifacts
0 commit comments