← All use cases

Artifact Provenance

Generate SLSA-compatible provenance attestations for build artifacts, anchored to a transparency log.

Implemented by

Confium Keyless

Sign releases without managing keys.

→ Product overview

Relevant to

Open Source Maintainer

Sign releases without managing keys.

→ Audience overview

Compliance / Audit Team

Prove your operations are auditable and tamper-evident.

→ Audience overview

How to evaluate

  1. 1. Read the relevant product overview

    Start with the product pages above for the architectural model.

  2. 2. Run the quickstart

    Each product page has a 5-minute quickstart that runs locally.

  3. 3. Read the spec

    Specs at /specs/PRODUCTS cover the protocol details.

  4. 4. Talk to us

    Open a Discussion on GitHub tagged `evaluation-help`.

Related use cases

CI/CD Signing

Sign build artifacts at release time using threshold keys held outside CI. Compromising CI does not compromise the signing key.

Certificate Transparency

Run an RFC 6962 transparency log for your CA. Every issued cert is appended; mis-issuance is detectable.

GitHub Release Signing

Sign GitHub release artifacts keylessly using OIDC. No long-lived signing key to manage or compromise.

OIDC-Based Keyless Signing

Use GitHub, Google, GitLab, Azure AD, or Okta as the identity provider for short-lived signing certificates.