veilor-org 25b8d30f35 ci: add cosign keyless sigs, SBOM, and provenance attestation ... Sign each ISO chunk with cosign keyless OIDC, generate an SPDX SBOM of the build output, and attach an in-toto build-provenance attestation. Sigs/certs/SBOM are uploaded alongside the ISO parts in the ci-latest rolling prerelease so the test/auto-install.sh path can verify before reassembling. Action versions are major-version tags (@v3, @v0, @v2). SHA-pinning is tracked separately to keep this PR small and avoid the long web lookups that stalled the previous attempt.		2026-05-06 10:40:56 +01:00
..
workflows	ci: add cosign keyless sigs, SBOM, and provenance attestation	2026-05-06 10:40:56 +01:00
CODEOWNERS	ci: switch refs from veilor → veilor-org (GH org slug); domain veilor.org	2026-04-30 13:59:20 +01:00
PULL_REQUEST_TEMPLATE.md	ci: github actions workflow (build-iso + lint), CONTRIBUTING, CODEOWNERS, PR template	2026-04-30 13:56:03 +01:00