INTRODUCING ARTIFACT ATTESTATION

Summary from the TLDR InfoSec newsletter

The OpenSSF and GitHub have launched Artifact Attestations to allow for generating SigStore artifact attestations but adding a GitHub action to configure the signature without the need to manage a PKI infrastructure. The signatures utilize the OpenSSF's PKI infrastructure and can be verified using the GitHub CLI. Integrations with Kubernetes and other providers are planned.