slsa-verifier adds npm package provenance and CI/CD verification for SLSA attestations

slsa-verifier, a command-line utility maintained by the SLSA Framework contributors, provides cryptographic verification of software build provenance for binaries, container images, and npm packages. The tool implements the Supply-chain Levels for Software Artifacts (SLSA) framework to validate that artifacts originated from authorized build processes by checking signatures, builder identities, source repositories, branches, and release tags.

The tool supports provenance generated by SLSA GitHub generators and Google Cloud Build, with experimental support for npm package provenance verification. It runs on Linux, macOS, and Windows, and is designed for integration into automated CI/CD workflows to verify software before distribution or deployment. The project is written in Go and released under the Apache License 2.0.

Verification capabilities and supported formats

• SLSA provenance verification: Checks cryptographic signatures on provenance attestations and compares recorded information against user-supplied expected values to confirm artifact origin.
• Builder and source validation: Validates the identity of the build system, confirms source repository origin, and verifies specific branches, release tags, and versioned tags.
• GitHub Actions integration: Supports validation of selected GitHub Actions workflow inputs and verification of multiple artifacts covered by a single attestation attestation.
• Container and npm support: Verifies container images referenced by immutable digests and includes experimental verification of npm package provenance.
• CI/CD automation features: Supports Verification Summary Attestations, prints underlying in-toto statements for inspection, and is built for integration into automated CI/CD pipelines.

Why it matters

Supply chain security tooling has become critical for Linux distributions and open-source software distribution as attacks on build systems and package repositories increase. slsa-verifier's support for GitHub Actions and Google Cloud Build covers major platforms used by open-source projects, while its experimental npm support extends protection to the JavaScript ecosystem that underpins much modern Linux application development. Integration into CI/CD workflows allows maintainers to automatically block deployment of artifacts with invalid or missing provenance, reducing reliance on manual verification and helping downstream users trust the software they install.