CI/Lock – signed evidence of what your CI ran

Show HN: CI/Lock – signed evidence of what your CI ran

CI/Lock – signed evidence of what your CI ran is a company in show hn launch.

Profile

I helped create Witness, donated it to the CNCF/in-toto ecosystem, and worked on the NIST 800-204D "pipeline observer" guidance. CI/Lock is the next version of that work, and it's under the Apache 2.0 license.Here's the gap it closes. In March, two supply-chain attacks hit within a week of each other. Someone force-pushed 75 of 76 version tags in aquasecurity/trivy-action, so every pipeline that had pinned to a tag (the thing we all tell people to do) pulled credential-stealing code on its next run. It read secrets from/proc/<pid>/environ and sent them to a typosquat. A few days later, two litellm releases on PyPI carried a stealer in a .pth file, which Python runs on startup. You didn't hav

Within the show hn launch space, the company focuses on its core offering rather than a broad product line.

Its current recorded stage is Show HN launch.

Website: cilock.dev