← Back to Labs

Supply Chain Signing Trust Path

Follow one release from digest and workload identity to provenance, transparency, and the final admission decision.

ScenarioSwitch failure modes and see which trust check breaks
Sourceeu-example/payments-apirefs/heads/maincommit 8c7dbf5f...Builder identityissuertoken.actions.githubusercontent.com.github/workflows/release.ymlSigned subjectregistry.example.eu/platform/payments-apisigned sha256:4c4dc1a8898...d0af6c7bdeploy sha256:4c4dc1a8898...d0af6c7bEvidenceprovenance matchlog includedrepo eu-example/payments-apiAdmissionALLOWworkflow expecteddigest exactsigFirst lock the subject to immutable bytes. Everything else hangs off that digest.Policy checksdigest okidentity okprovenance oklog okresult allow
Current scenario
Clean main-branch release
Release workflow on main produced the image, signed the same digest, logged the event, and attached matching provenance.
Trusted production identity
.github/workflows/release.yml
refs/heads/main
Decision
Accept: digest, identity, provenance, and transparency all match the expected release path.
Step 1 / 6The subject has to be one exact digest

A release tag is only a label. The verifier needs the exact digest of the artefact bytes that are about to run.

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →