Skip to main content

Introduction

Cimon Attest is a powerful tool designed to facilitate SLSA (Supply Chain Levels for Software Artifacts) attestation within the software development and deployment lifecycle. It simplifies the process of generating and managing provenance documents, ensuring the integrity and authenticity of software artifacts.

The Importance of Provenance​

Provenance refers to the historical record and origin of a software artifact. It provides transparency and auditable traceability, allowing stakeholders to verify software components' source, modifications, and interactions. Provenance is crucial in establishing the trustworthiness of artifacts and enhancing the security of the software supply chain.

When we address provenance, we refer to the latest v1.0 standard explained here: https://slsa.dev/provenance/v1.

SLSA Compliance​

SLSA compliance addresses the need for robust provenance generation and management. As explained in official SLSA standard, even the basic SLSA level (level 1) guidelines for capturing and maintaining provenance information throughout the software lifecycle. Cimon aligns with the SLSA specification and enables organizations to conform to these compliance requirements.

Regulatory Context (SSDF / NIST)​

Beyond SLSA, several regulatory frameworks require provenance generation as part of secure software development. Under Executive Order 14028, the National Institute of Standards and Technology (NIST) published the Secure Software Development Framework (SSDF / NIST SP 800-218), which calls out provenance explicitly:

PS.3.2 Collect, safeguard, maintain, and share provenance data for all components of each software release.

NIST defines provenance as:

The chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data.

Organisations subject to SSDF need tooling that emits and signs provenance documents alongside the software release process. Cimon's attestation flow is built to satisfy this requirement without bolting on a separate step.

Generating Attestation Documents​

To use Cimon, you must create your desired artifacts as part of your standard build process. Once the artifacts are ready, you can call Cimon Attest to generate an attestation document specifically for the artifacts. These documents contain metadata and cryptographic signatures, ensuring the authenticity and integrity of the artifact and its provenance source. Cimon tooling is runner-aware. Hence it identifies the environment in which it runs, captures all relevant information, and forms a verifiable document that can be passed to stakeholders.

Signing Artifacts​

Cimon Attest provides the additional capability to sign artifacts using supplied keys or certificates. This enhances the security and trustworthiness of the artifacts, enabling stakeholders to verify their authenticity and integrity. A signed provenance document is a must-have requirement for SLSA 2 and above.

Cimon With Cycode​

Cycode enhances the capabilities of Cimon and allows the following:

  • Browse all attestations reports and gain visibility across the organization.
  • Maintain an organization policy, such requirement for signed provenance documents, or specific signer identity.
  • Accessible storage for provenance documents correlated across the SDLC.
  • Reaching SLSA3 level by combining provenance information with CI/CD security capabilities.
  • And more.

If you are interested, please contact us via book a demo.

  • Runtime Security. Protect your build pipeline from supply-chain attacks alongside provenance generation.
  • Build Hardening. Pre-built rules that detect and block known supply-chain attack patterns during builds.
  • SBOM Generation. Generate build-time SBOMs using runtime observation for accurate dependency tracking.
  • Configuration Reference. Full list of attestation and signing environment variables.