laurentsimon

The binding between the source repository and the final artifact is the value you get. You could then verify from the GH Action https://github.com/docker/setup-buildx-action/blob/master/src/buildx.ts#L270, which would add transparency to users....

> If this is just info for the user then they can already get it plainly from that URL. We also put this info into our build artifacts(binaries/images) during build....

Wanted to mention an early adopter, Java' container tool jib https://github.com/GoogleContainerTools/jib/blob/master/.github/workflows/jib-cli-release.yml Thanks again all for the time you're taking to review this PR. I wanted to mention that none of...

Something I forgot to mention: The attestation PR https://github.com/moby/buildkit/pull/2935 is interesting. We plan to allow building from dockerfile / container image (https://github.com/slsa-framework/slsa-github-generator/issues/57). This is maybe something we could chat about...

> If this is just info for the user then they can already get it plainly from that URL. We also put this info into our build artifacts(binaries/images) during build....

Fyi, we onboarded another container project https://github.com/google/ko/blob/main/.github/workflows/release.yml#L38-L47

Hi all, just wanted to ping to see if you have any updates. Happy to talk over video if you want, about either this PR or even collaboration

Thanks. Sorry I'm OOO and will be back in a few weeks. I'll reach out when I'm back. Fyi, we're building a "bring your own builder" feature which would allow...

Thanks for tagging us @developer-guy ! We have these issues we're working on and may help for later improvement (as @asraa pointed out): https://github.com/slsa-framework/slsa-github-generator/issues/56 https://github.com/slsa-framework/slsa-github-generator/issues/590 Once these are ready, you...

> I'd love to help with them especially the ko related one 🙋🏻‍♂️🖖 @laurentsimon +1! Feel free to comment on the issue.