Support matrix
Pick where you build to see which SLSA and ALPS levels CI/lock reaches there today, which are planned, and which cannot be reached. A Supported result links to its setup guide. Every verdict is generated from a machine-checked model of SLSA v1.2 and ALPS, not written by hand, and pushgate.dev shows the same matrix.
- Supported works in released CI/lock today; links to its setup guide
- Planned tracked work; links to its entry below
- Not planned the model refutes it; the reason is shown
- 1 holds under a named reading of the spec (see Notes)
GitHub Actions
GitHub-hosted runner (Linux or macOS) 5 supported 1 planned 6 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
SLSA Source
- L1 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L2 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L3 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L4 Not plannedSource sideThe source host issues no Source VSA or source provenance.
ALPS
- 0 SupportedInlineSetup guide: GitHub Actions
- 1 SupportedInlineSetup guide: GitHub Actions
- 2 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: GitHub Actions
- L1 SupportedSetup guide: GitHub Actions
- L2 Supported (see note 1)Setup guide: GitHub Actions
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedSetup guide: GitHub Actions
- 1 SupportedSetup guide: GitHub Actions
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
Source side. Evidence about the source repository, its history and its reviews.
SLSA Source
- L1 Not plannedThe source host issues no Source VSA or source provenance.
- L2 Not plannedThe source host issues no Source VSA or source provenance.
- L3 Not plannedThe source host issues no Source VSA or source provenance.
- L4 Not plannedThe source host issues no Source VSA or source provenance.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
ALPS
- 0 PlannedIsolated provenance workflow
- 1 PlannedIsolated provenance workflow
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
GitHub-hosted runner, signing in a reusable workflow 5 supported 1 planned 6 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
SLSA Source
- L1 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L2 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L3 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L4 Not plannedSource sideThe source host issues no Source VSA or source provenance.
ALPS
- 0 SupportedInlineSetup guide: GitHub Actions
- 1 SupportedInlineSetup guide: GitHub Actions
- 2 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: GitHub Actions
- L1 SupportedSetup guide: GitHub Actions
- L2 Supported (see note 1)Setup guide: GitHub Actions
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedSetup guide: GitHub Actions
- 1 SupportedSetup guide: GitHub Actions
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
Source side. Evidence about the source repository, its history and its reviews.
SLSA Source
- L1 Not plannedThe source host issues no Source VSA or source provenance.
- L2 Not plannedThe source host issues no Source VSA or source provenance.
- L3 Not plannedThe source host issues no Source VSA or source provenance.
- L4 Not plannedThe source host issues no Source VSA or source provenance.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
ALPS
- 0 PlannedIsolated provenance workflow
- 1 PlannedIsolated provenance workflow
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
GitHub self-hosted runner 5 supported 0 planned 7 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: GitHub Actions
- L1 SupportedInlineSetup guide: GitHub Actions
- L2 Supported (see notes 1,2)InlineSetup guide: GitHub Actions
- L3 Not plannedInlineThe worker is reused between jobs, so builds are not isolated.
SLSA Source
- L1 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L2 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L3 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L4 Not plannedSource sideThe source host issues no Source VSA or source provenance.
ALPS
- 0 SupportedInlineSetup guide: GitHub Actions
- 1 SupportedInlineSetup guide: GitHub Actions
- 2 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: GitHub Actions
- L1 SupportedSetup guide: GitHub Actions
- L2 Supported (see notes 1,2)Setup guide: GitHub Actions
- L3 Not plannedThe worker is reused between jobs, so builds are not isolated.
ALPS
- 0 SupportedSetup guide: GitHub Actions
- 1 SupportedSetup guide: GitHub Actions
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
Source side. Evidence about the source repository, its history and its reviews.
SLSA Source
- L1 Not plannedThe source host issues no Source VSA or source provenance.
- L2 Not plannedThe source host issues no Source VSA or source provenance.
- L3 Not plannedThe source host issues no Source VSA or source provenance.
- L4 Not plannedThe source host issues no Source VSA or source provenance.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 PlannedIsolated provenance workflow
- L3 Not plannedThe worker is reused between jobs, so builds are not isolated.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 PlannedIsolated provenance workflow
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
cilockd (Linux). A signing daemon outside the build or agent, with a hardware-held key.
SLSA Build
- L0 Plannedcilockd on Linux
- L1 Plannedcilockd on Linux
- L2 Not plannedA tenant step, not the build platform, generates the provenance.
- L3 Not plannedA tenant step, not the build platform, generates the provenance.
ALPS
- 0 Plannedcilockd on Linux
- 1 Plannedcilockd on Linux
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
GitHub-hosted runner (Windows) 5 supported 1 planned 2 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
ALPS
- 0 SupportedInlineSetup guide: GitHub-hosted Windows runners
- 1 SupportedInlineSetup guide: GitHub-hosted Windows runners
- 2 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: GitHub-hosted Windows runners
- L1 SupportedSetup guide: GitHub-hosted Windows runners
- L2 Supported (see note 1)Setup guide: GitHub-hosted Windows runners
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedSetup guide: GitHub-hosted Windows runners
- 1 SupportedSetup guide: GitHub-hosted Windows runners
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
ALPS
- 0 PlannedIsolated provenance workflow
- 1 PlannedIsolated provenance workflow
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
cilockd (Windows). A signing daemon with a VBS-enclave key, outside the agent.
SLSA Build
- L0 Plannedcilockd on Windows
- L1 Plannedcilockd on Windows
- L2 Not plannedA tenant step, not the build platform, generates the provenance.
- L3 Not plannedA tenant step, not the build platform, generates the provenance.
ALPS
- 0 Plannedcilockd on Windows
- 1 Plannedcilockd on Windows
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
Other CI
GitLab.com hosted runners 4 supported 1 planned 7 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L1 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L2 Supported (see note 1)InlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L3 Not plannedInlineBuild steps can use the signing identity, so they can forge the provenance.
SLSA Source
- L1 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L2 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L3 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L4 Not plannedSource sideThe source host issues no Source VSA or source provenance.
ALPS
- 0 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- 1 PlannedInlinePlatform keyless signing beyond GitHub Actions
- 2 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L1 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L2 Supported (see note 1)Setup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- 1 PlannedPlatform keyless signing beyond GitHub Actions
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
Source side. Evidence about the source repository, its history and its reviews.
SLSA Source
- L1 Not plannedThe source host issues no Source VSA or source provenance.
- L2 Not plannedThe source host issues no Source VSA or source provenance.
- L3 Not plannedThe source host issues no Source VSA or source provenance.
- L4 Not plannedThe source host issues no Source VSA or source provenance.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 PlannedIsolated provenance workflow
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 PlannedIsolated provenance workflow
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
GitLab self-managed 3 supported 2 planned 7 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: Any CI with a signing key
- L1 SupportedInlineSetup guide: Any CI with a signing key
- L2 PlannedInlinePlatform keyless signing beyond GitHub Actions
- L3 Not plannedInlineNo certificate authority accepts this build's identity.
SLSA Source
- L1 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L2 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L3 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L4 Not plannedSource sideThe source host issues no Source VSA or source provenance.
ALPS
- 0 SupportedInlineSetup guide: Any CI with a signing key
- 1 PlannedInlinePlatform keyless signing beyond GitHub Actions
- 2 Not plannedInlineThe build has no workload identity the platform can certify.
- 3 Not plannedInlineThe build has no workload identity the platform can certify.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: Any CI with a signing key
- L1 SupportedSetup guide: Any CI with a signing key
- L2 PlannedPlatform keyless signing beyond GitHub Actions
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 SupportedSetup guide: Any CI with a signing key
- 1 PlannedPlatform keyless signing beyond GitHub Actions
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Source side. Evidence about the source repository, its history and its reviews.
SLSA Source
- L1 Not plannedThe source host issues no Source VSA or source provenance.
- L2 Not plannedThe source host issues no Source VSA or source provenance.
- L3 Not plannedThe source host issues no Source VSA or source provenance.
- L4 Not plannedThe source host issues no Source VSA or source provenance.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 Not plannedNo certificate authority accepts this build's identity.
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
cilockd (Linux). A signing daemon outside the build or agent, with a hardware-held key.
SLSA Build
- L0 Plannedcilockd on Linux
- L1 Plannedcilockd on Linux
- L2 Not plannedNo certificate authority accepts this build's identity.
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 Plannedcilockd on Linux
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Buildkite hosted agents 4 supported 1 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L1 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L2 Supported (see note 1)InlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L3 Not plannedInlineBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- 1 PlannedInlinePlatform keyless signing beyond GitHub Actions
- 2 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L1 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L2 Supported (see note 1)Setup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- 1 PlannedPlatform keyless signing beyond GitHub Actions
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 PlannedIsolated provenance workflow
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 PlannedIsolated provenance workflow
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
CircleCI cloud 4 supported 1 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L1 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L2 Supported (see notes 1,2)InlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L3 Not plannedInlineBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- 1 PlannedInlinePlatform keyless signing beyond GitHub Actions
- 2 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedInlineSteps run with root on this worker, so no sandbox can contain the agent.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L1 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L2 Supported (see notes 1,2)Setup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- 1 PlannedPlatform keyless signing beyond GitHub Actions
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 PlannedIsolated provenance workflow
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 PlannedIsolated provenance workflow
- 2 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
- 3 Not plannedSteps run with root on this worker, so no sandbox can contain the agent.
Jenkins 3 supported 2 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: Any CI with a signing key
- L1 SupportedInlineSetup guide: Any CI with a signing key
- L2 PlannedInlinePlatform keyless signing beyond GitHub Actions
- L3 Not plannedInlineNo certificate authority accepts this build's identity.
ALPS
- 0 SupportedInlineSetup guide: Any CI with a signing key
- 1 PlannedInlinePlatform keyless signing beyond GitHub Actions
- 2 Not plannedInlineThe build has no workload identity the platform can certify.
- 3 Not plannedInlineThe build has no workload identity the platform can certify.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: Any CI with a signing key
- L1 SupportedSetup guide: Any CI with a signing key
- L2 PlannedPlatform keyless signing beyond GitHub Actions
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 SupportedSetup guide: Any CI with a signing key
- 1 PlannedPlatform keyless signing beyond GitHub Actions
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 Not plannedNo certificate authority accepts this build's identity.
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
cilockd (Linux). A signing daemon outside the build or agent, with a hardware-held key.
SLSA Build
- L0 Plannedcilockd on Linux
- L1 Plannedcilockd on Linux
- L2 Not plannedNo certificate authority accepts this build's identity.
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 Plannedcilockd on Linux
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Azure DevOps Microsoft-hosted agents 3 supported 2 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: Any CI with a signing key
- L1 SupportedInlineSetup guide: Any CI with a signing key
- L2 PlannedInlinePlatform keyless signing beyond GitHub Actions
- L3 Not plannedInlineNo certificate authority accepts this build's identity.
ALPS
- 0 SupportedInlineSetup guide: Any CI with a signing key
- 1 PlannedInlinePlatform keyless signing beyond GitHub Actions
- 2 Not plannedInlineThe build has no workload identity the platform can certify.
- 3 Not plannedInlineThe build has no workload identity the platform can certify.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: Any CI with a signing key
- L1 SupportedSetup guide: Any CI with a signing key
- L2 PlannedPlatform keyless signing beyond GitHub Actions
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 SupportedSetup guide: Any CI with a signing key
- 1 PlannedPlatform keyless signing beyond GitHub Actions
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 Not plannedNo certificate authority accepts this build's identity.
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
AWS CodeBuild (on-demand) 3 supported 0 planned 5 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: Any CI with a signing key
- L1 SupportedInlineSetup guide: Any CI with a signing key
- L2 Not plannedInlineThe build has no workload identity token to sign with.
- L3 Not plannedInlineThe build has no workload identity token to sign with.
ALPS
- 0 SupportedInlineSetup guide: Any CI with a signing key
- 1 Not plannedInlineThe build has no workload identity the platform can certify.
- 2 Not plannedInlineThe build has no workload identity the platform can certify.
- 3 Not plannedInlineThe build has no workload identity the platform can certify.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: Any CI with a signing key
- L1 SupportedSetup guide: Any CI with a signing key
- L2 Not plannedThe build has no workload identity token to sign with.
- L3 Not plannedThe build has no workload identity token to sign with.
ALPS
- 0 SupportedSetup guide: Any CI with a signing key
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 Not plannedThe build has no workload identity token to sign with.
- L3 Not plannedThe build has no workload identity token to sign with.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Google Cloud Build 3 supported 2 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: Any CI with a signing key
- L1 SupportedInlineSetup guide: Any CI with a signing key
- L2 PlannedInlinePlatform keyless signing beyond GitHub Actions
- L3 Not plannedInlineNo certificate authority accepts this build's identity.
ALPS
- 0 SupportedInlineSetup guide: Any CI with a signing key
- 1 PlannedInlinePlatform keyless signing beyond GitHub Actions
- 2 Not plannedInlineThe build has no workload identity the platform can certify.
- 3 Not plannedInlineThe build has no workload identity the platform can certify.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: Any CI with a signing key
- L1 SupportedSetup guide: Any CI with a signing key
- L2 PlannedPlatform keyless signing beyond GitHub Actions
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 SupportedSetup guide: Any CI with a signing key
- 1 PlannedPlatform keyless signing beyond GitHub Actions
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 Not plannedNo certificate authority accepts this build's identity.
- L3 Not plannedNo certificate authority accepts this build's identity.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Kubernetes
Kubernetes pod (EKS, GKE or AKS) 4 supported 1 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L1 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L2 Supported (see notes 1,2,3)InlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L3 Not plannedInlineBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedInlineSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- 1 PlannedInlinePlatform keyless signing beyond GitHub Actions
- 2 Not plannedInlineThe build has no workload identity the platform can certify.
- 3 Not plannedInlineThe build has no workload identity the platform can certify.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L1 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L2 Supported (see notes 1,2,3)Setup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 SupportedSetup guide: GitLab.com, Buildkite, CircleCI and Kubernetes with public Sigstore
- 1 PlannedPlatform keyless signing beyond GitHub Actions
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Separate signer. A separate job, which the build steps cannot reach, signs the provenance.
SLSA Build
- L0 PlannedIsolated provenance workflow
- L1 PlannedIsolated provenance workflow
- L2 PlannedIsolated provenance workflow
- L3 Not plannedBuild steps can use the signing identity, so they can forge the provenance.
ALPS
- 0 PlannedIsolated provenance workflow
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Kubernetes pod with a cilockd sidecar 0 supported 5 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
ALPS
- 0 Plannedcilockd (Linux)cilockd on Linux
- 1 Not plannedcilockd (Linux)The build has no workload identity the platform can certify.
- 2 Not plannedcilockd (Linux)The build has no workload identity the platform can certify.
- 3 Not plannedcilockd (Linux)The build has no workload identity the platform can certify.
Results by CI/lock mode
cilockd (Linux). A signing daemon outside the build or agent, with a hardware-held key.
SLSA Build
ALPS
- 0 Plannedcilockd on Linux
- 1 Not plannedThe build has no workload identity the platform can certify.
- 2 Not plannedThe build has no workload identity the platform can certify.
- 3 Not plannedThe build has no workload identity the platform can certify.
Developer machines and agents
Pushgate (an agent pushes from a workstation) 4 supported 1 planned 7 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedPushgate mintSetup guide: Pushgate first signed push
- L1 SupportedPushgate mintSetup guide: Pushgate first signed push
- L2 Not plannedPushgate mintA personal workstation is not a hosted build platform.
- L3 Not plannedPushgate mintA personal workstation is not a hosted build platform.
SLSA Source
- L1 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L2 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L3 Not plannedSource sideThe source host issues no Source VSA or source provenance.
- L4 Not plannedSource sideThe source host issues no Source VSA or source provenance.
ALPS
- 0 SupportedPushgate mintSetup guide: Pushgate first signed push
- 1 SupportedPushgate mintSetup guide: Pushgate first signed push
- 2 PlannedPushgate mintALPS 2 boundary attestation
- 3 Not plannedPushgate mintNeeds the cilockd signing daemon, which this mode does not run.
Results by CI/lock mode
Pushgate mint. CI/lock signs on the developer machine; Pushgate verifies the evidence at git push.
SLSA Build
- L0 SupportedSetup guide: Pushgate first signed push
- L1 SupportedSetup guide: Pushgate first signed push
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
ALPS
- 0 SupportedSetup guide: Pushgate first signed push
- 1 SupportedSetup guide: Pushgate first signed push
- 2 PlannedALPS 2 boundary attestation
- 3 Not plannedNeeds the cilockd signing daemon, which this mode does not run.
Source side. Evidence about the source repository, its history and its reviews.
SLSA Source
- L1 Not plannedThe source host issues no Source VSA or source provenance.
- L2 Not plannedThe source host issues no Source VSA or source provenance.
- L3 Not plannedThe source host issues no Source VSA or source provenance.
- L4 Not plannedThe source host issues no Source VSA or source provenance.
cilockd (Linux). A signing daemon outside the build or agent, with a hardware-held key.
SLSA Build
- L0 Plannedcilockd on Linux
- L1 Plannedcilockd on Linux
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
ALPS
- 0 Plannedcilockd on Linux
- 1 Plannedcilockd on Linux
- 2 Plannedcilockd on Linux
- 3 Not plannedThe machine offers no hardware-attested signing key.
Developer workstation (macOS or Linux) 4 supported 1 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: An enrolled agent on a workstation
- L1 SupportedInlineSetup guide: An enrolled agent on a workstation
- L2 Not plannedInlineA personal workstation is not a hosted build platform.
- L3 Not plannedInlineA personal workstation is not a hosted build platform.
ALPS
- 0 SupportedInlineSetup guide: An enrolled agent on a workstation
- 1 SupportedInlineSetup guide: An enrolled agent on a workstation
- 2 PlannedInlineALPS 2 boundary attestation
- 3 Not plannedInlineNeeds the cilockd signing daemon, which this mode does not run.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: An enrolled agent on a workstation
- L1 SupportedSetup guide: An enrolled agent on a workstation
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
ALPS
- 0 SupportedSetup guide: An enrolled agent on a workstation
- 1 SupportedSetup guide: An enrolled agent on a workstation
- 2 PlannedALPS 2 boundary attestation
- 3 Not plannedNeeds the cilockd signing daemon, which this mode does not run.
cilockd (Linux). A signing daemon outside the build or agent, with a hardware-held key.
SLSA Build
- L0 Plannedcilockd on Linux
- L1 Plannedcilockd on Linux
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
ALPS
- 0 Plannedcilockd on Linux
- 1 Plannedcilockd on Linux
- 2 Plannedcilockd on Linux
- 3 Not plannedThe machine offers no hardware-attested signing key.
Linux workstation with a TPM 4 supported 2 planned 2 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 SupportedInlineSetup guide: An enrolled agent on a workstation
- L1 SupportedInlineSetup guide: An enrolled agent on a workstation
- L2 Not plannedInlineA personal workstation is not a hosted build platform.
- L3 Not plannedInlineA personal workstation is not a hosted build platform.
Results by CI/lock mode
Inline. CI/lock runs and signs inside the build job or agent session.
SLSA Build
- L0 SupportedSetup guide: An enrolled agent on a workstation
- L1 SupportedSetup guide: An enrolled agent on a workstation
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
ALPS
- 0 SupportedSetup guide: An enrolled agent on a workstation
- 1 SupportedSetup guide: An enrolled agent on a workstation
- 2 PlannedALPS 2 boundary attestation
- 3 Not plannedNeeds the cilockd signing daemon, which this mode does not run.
cilockd (Linux). A signing daemon outside the build or agent, with a hardware-held key.
SLSA Build
- L0 Plannedcilockd on Linux
- L1 Plannedcilockd on Linux
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
macOS with cilockd
macOS 27, Apple silicon, MDM-managed 0 supported 6 planned 2 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 Plannedcilockd (macOS)cilockd on macOS
- L1 Plannedcilockd (macOS)cilockd on macOS
- L2 Not plannedcilockd (macOS)A personal workstation is not a hosted build platform.
- L3 Not plannedcilockd (macOS)A personal workstation is not a hosted build platform.
Results by CI/lock mode
cilockd (macOS). A signing daemon with an App Attest key, outside the agent.
SLSA Build
- L0 Plannedcilockd on macOS
- L1 Plannedcilockd on macOS
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
macOS 27, Apple silicon, unmanaged 0 supported 6 planned 2 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 Plannedcilockd (macOS)cilockd on macOS
- L1 Plannedcilockd (macOS)cilockd on macOS
- L2 Not plannedcilockd (macOS)A personal workstation is not a hosted build platform.
- L3 Not plannedcilockd (macOS)A personal workstation is not a hosted build platform.
Results by CI/lock mode
cilockd (macOS). A signing daemon with an App Attest key, outside the agent.
SLSA Build
- L0 Plannedcilockd on macOS
- L1 Plannedcilockd on macOS
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
Intel Mac 0 supported 5 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 Plannedcilockd (macOS)cilockd on macOS
- L1 Plannedcilockd (macOS)cilockd on macOS
- L2 Not plannedcilockd (macOS)A personal workstation is not a hosted build platform.
- L3 Not plannedcilockd (macOS)A personal workstation is not a hosted build platform.
ALPS
- 0 Plannedcilockd (macOS)cilockd on macOS
- 1 Plannedcilockd (macOS)cilockd on macOS
- 2 Plannedcilockd (macOS)cilockd on macOS
- 3 Not plannedcilockd (macOS)The machine offers no hardware-attested signing key.
Results by CI/lock mode
cilockd (macOS). A signing daemon with an App Attest key, outside the agent.
SLSA Build
- L0 Plannedcilockd on macOS
- L1 Plannedcilockd on macOS
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
ALPS
- 0 Plannedcilockd on macOS
- 1 Plannedcilockd on macOS
- 2 Plannedcilockd on macOS
- 3 Not plannedThe machine offers no hardware-attested signing key.
Windows with cilockd
Windows 11, TPM and Secure Boot, Intune-managed 0 supported 6 planned 2 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 Plannedcilockd (Windows)cilockd on Windows
- L1 Plannedcilockd (Windows)cilockd on Windows
- L2 Not plannedcilockd (Windows)A personal workstation is not a hosted build platform.
- L3 Not plannedcilockd (Windows)A personal workstation is not a hosted build platform.
Results by CI/lock mode
cilockd (Windows). A signing daemon with a VBS-enclave key, outside the agent.
SLSA Build
- L0 Plannedcilockd on Windows
- L1 Plannedcilockd on Windows
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
Windows 11, TPM and Secure Boot, unmanaged 0 supported 6 planned 2 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 Plannedcilockd (Windows)cilockd on Windows
- L1 Plannedcilockd (Windows)cilockd on Windows
- L2 Not plannedcilockd (Windows)A personal workstation is not a hosted build platform.
- L3 Not plannedcilockd (Windows)A personal workstation is not a hosted build platform.
Results by CI/lock mode
cilockd (Windows). A signing daemon with a VBS-enclave key, outside the agent.
SLSA Build
- L0 Plannedcilockd on Windows
- L1 Plannedcilockd on Windows
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
Windows Server 2025 on Azure Trusted Launch (self-hosted runner) 0 supported 7 planned 1 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 Plannedcilockd (Windows)cilockd on Windows
- L1 Plannedcilockd (Windows)cilockd on Windows
- L2 Plannedcilockd (Windows)cilockd on Windows
- L3 Not plannedcilockd (Windows)The worker is reused between jobs, so builds are not isolated.
Results by CI/lock mode
cilockd (Windows). A signing daemon with a VBS-enclave key, outside the agent.
SLSA Build
- L0 Plannedcilockd on Windows
- L1 Plannedcilockd on Windows
- L2 Plannedcilockd on Windows
- L3 Not plannedThe worker is reused between jobs, so builds are not isolated.
Windows without a TPM, or with Secure Boot off 0 supported 5 planned 3 not planned
The best result across CI/lock modes. The mode is named under each result.
SLSA Build
- L0 Plannedcilockd (Windows)cilockd on Windows
- L1 Plannedcilockd (Windows)cilockd on Windows
- L2 Not plannedcilockd (Windows)A personal workstation is not a hosted build platform.
- L3 Not plannedcilockd (Windows)A personal workstation is not a hosted build platform.
ALPS
- 0 Plannedcilockd (Windows)cilockd on Windows
- 1 Plannedcilockd (Windows)cilockd on Windows
- 2 Plannedcilockd (Windows)cilockd on Windows
- 3 Not plannedcilockd (Windows)The machine offers no hardware-attested signing key.
Results by CI/lock mode
cilockd (Windows). A signing daemon with a VBS-enclave key, outside the agent.
SLSA Build
- L0 Plannedcilockd on Windows
- L1 Plannedcilockd on Windows
- L2 Not plannedA personal workstation is not a hosted build platform.
- L3 Not plannedA personal workstation is not a hosted build platform.
ALPS
- 0 Plannedcilockd on Windows
- 1 Plannedcilockd on Windows
- 2 Plannedcilockd on Windows
- 3 Not plannedThe machine offers no hardware-attested signing key.
Source repositories
GitHub repository that only Pushgate can push to 0 supported 4 planned 0 not planned
The best result across CI/lock modes. The mode is named under each result.
Results by CI/lock mode
Pushgate Source VSA. Pushgate signs a SLSA Source verification summary for each push it admits.
GitHub repository that also accepts direct pushes 0 supported 4 planned 0 not planned
The best result across CI/lock modes. The mode is named under each result.
Results by CI/lock mode
Pushgate Source VSA. Pushgate signs a SLSA Source verification summary for each push it admits.
Full matrix: every environment, best result
| Environment | SLSA Build | SLSA Source | ALPS | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SLSA Build L0 | SLSA Build L1 | SLSA Build L2 | SLSA Build L3 | SLSA Source L1 | SLSA Source L2 | SLSA Source L3 | SLSA Source L4 | ALPS 0 | ALPS 1 | ALPS 2 | ALPS 3 | |
| GitHub Actions | ||||||||||||
| GitHub-hosted runner (Linux or macOS) | (see note 1) | |||||||||||
| GitHub-hosted runner, signing in a reusable workflow | (see note 1) | |||||||||||
| GitHub self-hosted runner | (see notes 1,2) | |||||||||||
| GitHub-hosted runner (Windows) | (see note 1) | not evaluated | not evaluated | not evaluated | not evaluated | |||||||
| Other CI | ||||||||||||
| GitLab.com hosted runners | (see note 1) | |||||||||||
| GitLab self-managed | ||||||||||||
| Buildkite hosted agents | (see note 1) | not evaluated | not evaluated | not evaluated | not evaluated | |||||||
| CircleCI cloud | (see notes 1,2) | not evaluated | not evaluated | not evaluated | not evaluated | |||||||
| Jenkins | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Azure DevOps Microsoft-hosted agents | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| AWS CodeBuild (on-demand) | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Google Cloud Build | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Kubernetes | ||||||||||||
| Kubernetes pod (EKS, GKE or AKS) | (see notes 1,2,3) | not evaluated | not evaluated | not evaluated | not evaluated | |||||||
| Kubernetes pod with a cilockd sidecar | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Developer machines and agents | ||||||||||||
| Pushgate (an agent pushes from a workstation) | ||||||||||||
| Developer workstation (macOS or Linux) | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Linux workstation with a TPM | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| macOS with cilockd | ||||||||||||
| macOS 27, Apple silicon, MDM-managed | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| macOS 27, Apple silicon, unmanaged | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Intel Mac | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Windows with cilockd | ||||||||||||
| Windows 11, TPM and Secure Boot, Intune-managed | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Windows 11, TPM and Secure Boot, unmanaged | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Windows Server 2025 on Azure Trusted Launch (self-hosted runner) | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Windows without a TPM, or with Secure Boot off | not evaluated | not evaluated | not evaluated | not evaluated | ||||||||
| Source repositories | ||||||||||||
| GitHub repository that only Pushgate can push to | not evaluated | not evaluated | not evaluated | not evaluated | not evaluated | not evaluated | not evaluated | not evaluated | ||||
| GitHub repository that also accepts direct pushes | not evaluated | not evaluated | not evaluated | not evaluated | not evaluated | not evaluated | not evaluated | not evaluated | ||||
Planned work
- Isolated provenance workflow
- A reusable GitHub workflow signs the provenance in a job the build steps cannot reach. It is the separate-signer mode, which would bring SLSA Build L3 to GitHub Actions. The workflow and the L3 verifier are not merged yet, and the provenance format fix is open.
- ALPS 2 boundary attestation
- A trusted observer outside the agent records the sandbox that was applied, so a verifier can check it. Designed, not built.
- cilockd on Linux
- A signing daemon outside the build or agent, with a TPM-held key and a measured daemon identity.
- cilockd on macOS
- A signing daemon whose key is attested by Apple App Attest, through a helper app the agent cannot drive.
- cilockd on Windows
- A signing daemon whose key lives in a VBS enclave, with a TPM quote of the boot state.
- Platform keyless signing beyond GitHub Actions
- The platform certificate authority accepts GitHub Actions, GitLab.com, Buildkite and CircleCI workload identities. No guide documents platform keyless signing on GitLab.com, Buildkite or CircleCI yet, so ALPS 1 there is listed as planned until one does.
- Pushgate Source VSA
- Pushgate verifies every push it gates but does not yet issue a SLSA Source VSA for it. Designed, not built.
Notes
- Holds under interpretation I1: provenance that a CI/lock step writes on the build platform's own workers, signed with the job's workload identity, counts as generated by the control plane (SLSA Build L2, Authentic). GitHub publishes this reading for its own artifact attestations. Under the strict reading, no environment reaches Build L2 today.
- Holds under interpretation I2: the organization that operates self-hosted workers or a cluster is the build platform, and its build steps are the tenants.
- Rests on a property that no vendor document or code confirms: k8s_pod.issuer_uniform.
Not shown: the draft SLSA Build Environment and Dependency tracks. The Source track is evaluated only where CI/lock collects source-side evidence.
Generated from formal/slsa-tracks/matrix.json (sha256 be858e073977), a Lean 4 model of SLSA v1.2 (Build, Source) + working draft (BuildEnv, Dependency); ALPS 0.1. Each cell is a theorem. Supported cells were checked against shipped code on main at cbc65c7e41 on 2026-09-25.
How to read it
- Best available shows, for each level, the best result across CI/lock's modes and names the mode. Pick a mode to see that mode alone.
- Inline means CI/lock signs inside the build job or agent session it observes. Code in that job can use the same signing identity, which is enough for ALPS 1, and for SLSA Build L2 once cilock emits the SLSA v1 provenance type (it emits v1.0 today; that fix is tracked in the matrix above), and is why no inline result reaches Build L3 or ALPS 3. The separate-signer and cilockd modes move the signer out of the build's reach.
- A level is a claim a verifier makes, not one CI/lock makes about itself. What proves a level lists the policy that checks each one.
Reference generated from the product documentation. Match commands and support details to your installed release.