artifact-signing

https://forgeproof.flyingcloudtech.com

Pack entire environments as self-contained boxes (eg. an AI Model). Pinned, validated, signed and air-gappable, for macOS Metal, Linux and Windows (CPU and CUDA).

Sign release artifacts with Minisign, verify them, and optionally log signatures to Sigstore Rekor.

CI/CD release risk scanner with supply-chain artifact gates, post-deploy evidence, CLI/API parity, metrics, Kubernetes, and Terraform

Sign artifacts and container images using Cosign/Sigstore

Software supply-chain security domain repository delivering modular components for artifact signing, build attestation, provenance tracking, SBOM generation, policy enforcement, and runtime integrity — designed to enable verifiable, tamper-resistant delivery pipelines.