mirror of
https://github.com/git-pkgs/proxy.git
synced 2026-08-23 04:14:57 -04:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
7edec36d0dExtract each platform's SPDX document from the BuildKit SBOM attestation and sign it as a cosign spdxjson attestation against the manifest-list digest, so downstream consumers (e.g. Kyverno image-verification policies) can verify the predicate signature rather than relying on the unsigned BuildKit attachment. |
||
| .. | ||
| workflows | ||
| dependabot.yml | ||