sabinghost19/VBBI Voucher Attestor
Generate a Voucher-Based Build Integrity predicate and attach it as a Cosign attestation
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| image | Immutable image reference in digest form | yes | — |
| commit-sha | Git commit SHA associated with the build | yes | — |
| step-spec-path | Path to a JSON file containing the ordered list of VBBI steps and metadata files | yes | — |
| hmac-key | Shared HMAC key used to seal the voucher in this stage | no | dev-only-vbbi-key |
| vault-address | Vault base URL used for Transit HMAC generation | no | "" |
| vault-token | Vault token used to access Transit when vault-address is configured | no | "" |
| vault-namespace | Optional Vault enterprise namespace | no | "" |
| vault-transit-mount | Vault Transit mount path | no | transit |
| vault-transit-key | Vault Transit key name used to compute the VBBI HMAC chain | no | "" |
| vault-transit-algorithm | Vault Transit HMAC algorithm | no | sha2-256 |
| slsa-level | SLSA level declared in the voucher build context | no | 3 |
| attestation-type | Cosign attestation type for the VBBI voucher | no | https://devsecops.licenta.ro/VBBI/v1 |
Outputs
| name | description |
|---|---|
| merkle-root | Computed Merkle root for the generated VBBI voucher |
| predicate-path | Path to the generated VBBI predicate JSON file |