{"id":27422595,"url":"https://github.com/goreleaser/example-slsa-provenance","last_synced_at":"2026-04-18T22:07:37.664Z","repository":{"id":189343885,"uuid":"618091561","full_name":"goreleaser/example-slsa-provenance","owner":"goreleaser","description":"Example project using SLSA 3 Generic Generator with GoReleaser","archived":false,"fork":false,"pushed_at":"2023-10-26T16:53:27.000Z","size":25,"stargazers_count":10,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-10-18T23:54:06.171Z","etag":null,"topics":["goreleaser","slsa","slsa-framework","slsa-generic-generator","slsa-provenance","slsa3","slsalevel3"],"latest_commit_sha":null,"homepage":"https://goreleaser.com","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/goreleaser.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null},"funding":{"github":["caarlos0"],"open_collective":"goreleaser","custom":["https://goreleaser.com/pro"]}},"created_at":"2023-03-23T18:26:59.000Z","updated_at":"2025-02-13T17:41:45.000Z","dependencies_parsed_at":"2023-10-03T12:57:28.946Z","dependency_job_id":"a26e750a-f988-4930-b4cf-d821eee177f4","html_url":"https://github.com/goreleaser/example-slsa-provenance","commit_stats":{"total_commits":5,"total_committers":3,"mean_commits":"1.6666666666666667","dds":0.4,"last_synced_commit":"b045ad49ff6d26c3e332f4438698ead58e072be2"},"previous_names":["goreleaser/goreleaser-example-slsa-provenance","developer-guy/goreleaser-slsa-provenance","goreleaser/example-slsa-provenance"],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/goreleaser/example-slsa-provenance","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/goreleaser%2Fexample-slsa-provenance","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/goreleaser%2Fexample-slsa-provenance/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/goreleaser%2Fexample-slsa-provenance/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/goreleaser%2Fexample-slsa-provenance/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/goreleaser","download_url":"https://codeload.github.com/goreleaser/example-slsa-provenance/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/goreleaser%2Fexample-slsa-provenance/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31986368,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-18T20:23:30.271Z","status":"ssl_error","status_checked_at":"2026-04-18T20:23:29.375Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["goreleaser","slsa","slsa-framework","slsa-generic-generator","slsa-provenance","slsa3","slsalevel3"],"created_at":"2025-04-14T10:41:03.486Z","updated_at":"2026-04-18T22:07:37.609Z","avatar_url":"https://github.com/goreleaser.png","language":"Go","funding_links":["https://github.com/sponsors/caarlos0","https://opencollective.com/goreleaser","https://goreleaser.com/pro"],"categories":[],"sub_categories":[],"readme":"# How to generate SLSA provenance for your artifacts built by GoReleaser?\n\n[SLSA](https://slsa.dev) (Supply Chain Levels for Software Artifacts) provenance is a framework for recording and verifying the integrity and security of software components throughout their lifecycle, from development to deployment.\n\nIt is a set of standards and best practices designed to increase transparency and accountability in software supply chains. SLSA aims to provide a consistent way to communicate the security and integrity of software components and their dependencies, enabling organizations to make informed decisions about the software they use.\n\nSLSA defines four levels of supply chain security, with each level building on the previous one. At each level, specific security measures are implemented and verified to ensure the integrity of the software supply chain. The four levels of SLSA are:\n\n- Level 0: none\n- Level 1: Attestation showing that the package was built as expected\n- Level 2: Signed attestation, generated by a hosted build service\n- Level 3: Hardened build service\n\n\u003e _\u003chttps://slsa.dev/spec/v1.0-rc1/levels\u003e_\n\nSLSA is becoming increasingly important as more organizations rely on software components from third-party sources, and as the risks associated with supply chain attacks continue to rise.\n\nSLSA Community provides a set of [builders](https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders) to help organizations implement SLSA requirements by using GitHub Action workflows that can be used to generate SLSA provenance for your projects.\n\nIn this example, we used SLSA 3 Generic Builder to generate SLSA provenance for a Go project. To get more detail, you can read the following blog post from the SLSA community:\n\n\u003e _\u003chttps://slsa.dev/blog/2022/08/slsa-github-workflows-generic-ga\u003e_\n\n## Furthermore\n\nAs a next step, you can verify your attestation by using a tool called [slsa-verifier](https://github.com/slsa-framework/slsa-verifier) to verify the signature of the generated provenance file, as these builders use Sigstore utilities to sign the generated provenance file with a keyless approach which also means that they upload it to the transparency log server called [Rekor](https://github.com/sigstore/rekor).\n\n- to install slsa-verifier: `nix-env -iA nixos.slsa-verifier`\n- to install rekor-cli: `nix-env -iA nixos.rekor-cli`\n\nTo verify the artifacts, you should download the tarballs/binaries and the provenance file first:\n\n```bash\ngh release download -R developer-guy/goreleaser-slsa-provenance -p \"*.intoto.jsonl\"\ngh release download -R developer-guy/goreleaser-slsa-provenance -p \"*.tar.gz\"\n```\n\nThen, you can grab the log entry UUID by searching the attestation checksum in the Rekor transparency log server::\n\n```bash\n$ rekor-cli search --artifact multiple.intoto.jsonl\nFound matching entries (listed by UUID):\n24296fb24b8ad77aa15437c51886ccc312ca822f1c67cb4c436cf79f57e1f637ed992cd162530242\n```\n\nThen, you can use `rekor-cli` to get the log entry:\n\n```bash\n$ rekor-cli get --format=json --uuid 24296fb24b8ad77aa15437c51886ccc312ca822f1c67cb4c436cf79f57e1f637ed992c\nd162530242 | jq -r '.Attestation' | jq\n```\n\n\u003cdetails\u003e\n  \u003csummary\u003eYou can click to see the whole attestation file☝️\u003c/summary\u003e\n\n```json\n  {\n  \"_type\": \"https://in-toto.io/Statement/v0.1\",\n  \"predicateType\": \"https://slsa.dev/provenance/v0.2\",\n  \"subject\": [\n    {\n      \"name\": \"goreleaser-slsa-provenance_Linux_arm64.tar.gz\",\n      \"digest\": {\n        \"sha256\": \"348a036ba9cfb9f8db615dd1576e02f84179a7702af1a5b951605ad0ba3e8881\"\n      }\n    },\n    {\n      \"name\": \"goreleaser-slsa-provenance_Linux_i386.tar.gz\",\n      \"digest\": {\n        \"sha256\": \"41c08429b25207640b1bb85e073598576289c52e1b2b45de91d5f16f4b00d947\"\n      }\n    },\n    {\n      \"name\": \"goreleaser-slsa-provenance_Windows_x86_64.zip\",\n      \"digest\": {\n        \"sha256\": \"b906d86a8bc858418e6aea7cd7902b71bc49093b8dc9eb7289bf821c835d213b\"\n      }\n    },\n    {\n      \"name\": \"goreleaser-slsa-provenance_Windows_i386.zip\",\n      \"digest\": {\n        \"sha256\": \"c3c77ba71afda6fc604aae346d88fcf7c24d9fe14c65a722a4ac5043edd090a8\"\n      }\n    },\n    {\n      \"name\": \"goreleaser-slsa-provenance_Windows_arm64.zip\",\n      \"digest\": {\n        \"sha256\": \"d3e3013c414d12aae109ba1dff80403f53e739d0ec8d7aa8a07547762829fce4\"\n      }\n    },\n    {\n      \"name\": \"goreleaser-slsa-provenance_Linux_x86_64.tar.gz\",\n      \"digest\": {\n        \"sha256\": \"f470df89804b082de3f850bbe7c3b3525417b5593dd055c9c3a5b4ce3c869155\"\n      }\n    },\n    {\n      \"name\": \"goreleaser-slsa-provenance_Darwin_x86_64.tar.gz\",\n      \"digest\": {\n        \"sha256\": \"f6c4193d85726a7e2334b79ed272103c992f2ca154a6f828a508b2e26a7f8333\"\n      }\n    },\n    {\n      \"name\": \"goreleaser-slsa-provenance_Darwin_arm64.tar.gz\",\n      \"digest\": {\n        \"sha256\": \"fedddadb2fa79b655e0c5c53ccbdfcbe0675196b9e167e1ce557f9e120394f85\"\n      }\n    }\n  ],\n  \"predicate\": {\n    \"builder\": {\n      \"id\": \"https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.5.0\"\n    },\n    \"buildType\": \"https://github.com/slsa-framework/slsa-github-generator/generic@v1\",\n    \"invocation\": {\n      \"configSource\": {\n        \"uri\": \"git+https://github.com/developer-guy/goreleaser-slsa-provenance@refs/tags/v0.1.0\",\n        \"digest\": {\n          \"sha1\": \"af2de62d809c3b5e3ccd2653f4b476a7bc968226\"\n        },\n        \"entryPoint\": \".github/workflows/goreleaser.yml\"\n      },\n      \"parameters\": {},\n      \"environment\": {\n        \"github_actor\": \"developer-guy\",\n        \"github_actor_id\": \"16693043\",\n        \"github_base_ref\": \"\",\n        \"github_event_name\": \"push\",\n        \"github_event_payload\": {\n          \"after\": \"1fde625cd60958063efdbf68cfbe63bd1ab07c7d\",\n          \"base_ref\": null,\n          \"before\": \"dd75abd3b58033c7416bb631b9116863616358cd\",\n          \"commits\": [],\n          \"compare\": \"https://github.com/developer-guy/goreleaser-slsa-provenance/compare/dd75abd3b580...1fde625cd609\",\n          \"created\": false,\n          \"deleted\": false,\n          \"forced\": true,\n          \"head_commit\": {\n            \"author\": {\n              \"email\": \"batuhan.apaydin@trendyol.com\",\n              \"name\": \"Batuhan Apaydın\",\n              \"username\": \"developer-guy\"\n            },\n            \"committer\": {\n              \"email\": \"batuhan.apaydin@trendyol.com\",\n              \"name\": \"Batuhan Apaydın\",\n              \"username\": \"developer-guy\"\n            },\n            \"distinct\": true,\n            \"id\": \"af2de62d809c3b5e3ccd2653f4b476a7bc968226\",\n            \"message\": \"initial commit\\n\\nSigned-off-by: Batuhan Apaydın \u003cbatuhan.apaydin@trendyol.com\u003e\",\n            \"timestamp\": \"2023-03-23T22:40:10+03:00\",\n            \"tree_id\": \"e094c3bc9c86a896315564f7fdd3d4916ba10628\",\n            \"url\": \"https://github.com/developer-guy/goreleaser-slsa-provenance/commit/af2de62d809c3b5e3ccd2653f4b476a7bc968226\"\n          },\n          \"pusher\": {\n            \"email\": \"developerguyn@gmail.com\",\n            \"name\": \"developer-guy\"\n          },\n          \"ref\": \"refs/tags/v0.1.0\",\n          \"repository\": {\n            \"allow_forking\": true,\n            \"archive_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/{archive_format}{/ref}\",\n            \"archived\": false,\n            \"assignees_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/assignees{/user}\",\n            \"blobs_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/git/blobs{/sha}\",\n            \"branches_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/branches{/branch}\",\n            \"clone_url\": \"https://github.com/developer-guy/goreleaser-slsa-provenance.git\",\n            \"collaborators_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/collaborators{/collaborator}\",\n            \"comments_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/comments{/number}\",\n            \"commits_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/commits{/sha}\",\n            \"compare_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/compare/{base}...{head}\",\n            \"contents_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/contents/{+path}\",\n            \"contributors_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/contributors\",\n            \"created_at\": 1679596019,\n            \"default_branch\": \"master\",\n            \"deployments_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/deployments\",\n            \"description\": \"A demonstration of showing how to use SLSA 3 Generic Generator with GoReleaser to release artifacts while generating signed SLSA provenance\",\n            \"disabled\": false,\n            \"downloads_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/downloads\",\n            \"events_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/events\",\n            \"fork\": false,\n            \"forks\": 0,\n            \"forks_count\": 0,\n            \"forks_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/forks\",\n            \"full_name\": \"developer-guy/goreleaser-slsa-provenance\",\n            \"git_commits_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/git/commits{/sha}\",\n            \"git_refs_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/git/refs{/sha}\",\n            \"git_tags_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/git/tags{/sha}\",\n            \"git_url\": \"git://github.com/developer-guy/goreleaser-slsa-provenance.git\",\n            \"has_discussions\": false,\n            \"has_downloads\": true,\n            \"has_issues\": true,\n            \"has_pages\": false,\n            \"has_projects\": true,\n            \"has_wiki\": true,\n            \"homepage\": \"\",\n            \"hooks_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/hooks\",\n            \"html_url\": \"https://github.com/developer-guy/goreleaser-slsa-provenance\",\n            \"id\": 618091561,\n            \"is_template\": false,\n            \"issue_comment_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/issues/comments{/number}\",\n            \"issue_events_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/issues/events{/number}\",\n            \"issues_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/issues{/number}\",\n            \"keys_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/keys{/key_id}\",\n            \"labels_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/labels{/name}\",\n            \"language\": \"Go\",\n            \"languages_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/languages\",\n            \"license\": {\n              \"key\": \"apache-2.0\",\n              \"name\": \"Apache License 2.0\",\n              \"node_id\": \"MDc6TGljZW5zZTI=\",\n              \"spdx_id\": \"Apache-2.0\",\n              \"url\": \"https://api.github.com/licenses/apache-2.0\"\n            },\n            \"master_branch\": \"master\",\n            \"merges_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/merges\",\n            \"milestones_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/milestones{/number}\",\n            \"mirror_url\": null,\n            \"name\": \"goreleaser-slsa-provenance\",\n            \"node_id\": \"R_kgDOJNdUKQ\",\n            \"notifications_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/notifications{?since,all,participating}\",\n            \"open_issues\": 0,\n            \"open_issues_count\": 0,\n            \"owner\": {\n              \"avatar_url\": \"https://avatars.githubusercontent.com/u/16693043?v=4\",\n              \"email\": \"developerguyn@gmail.com\",\n              \"events_url\": \"https://api.github.com/users/developer-guy/events{/privacy}\",\n              \"followers_url\": \"https://api.github.com/users/developer-guy/followers\",\n              \"following_url\": \"https://api.github.com/users/developer-guy/following{/other_user}\",\n              \"gists_url\": \"https://api.github.com/users/developer-guy/gists{/gist_id}\",\n              \"gravatar_id\": \"\",\n              \"html_url\": \"https://github.com/developer-guy\",\n              \"id\": 16693043,\n              \"login\": \"developer-guy\",\n              \"name\": \"developer-guy\",\n              \"node_id\": \"MDQ6VXNlcjE2NjkzMDQz\",\n              \"organizations_url\": \"https://api.github.com/users/developer-guy/orgs\",\n              \"received_events_url\": \"https://api.github.com/users/developer-guy/received_events\",\n              \"repos_url\": \"https://api.github.com/users/developer-guy/repos\",\n              \"site_admin\": false,\n              \"starred_url\": \"https://api.github.com/users/developer-guy/starred{/owner}{/repo}\",\n              \"subscriptions_url\": \"https://api.github.com/users/developer-guy/subscriptions\",\n              \"type\": \"User\",\n              \"url\": \"https://api.github.com/users/developer-guy\"\n            },\n            \"private\": false,\n            \"pulls_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/pulls{/number}\",\n            \"pushed_at\": 1679600419,\n            \"releases_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/releases{/id}\",\n            \"size\": 8,\n            \"ssh_url\": \"git@github.com:developer-guy/goreleaser-slsa-provenance.git\",\n            \"stargazers\": 0,\n            \"stargazers_count\": 0,\n            \"stargazers_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/stargazers\",\n            \"statuses_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/statuses/{sha}\",\n            \"subscribers_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/subscribers\",\n            \"subscription_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/subscription\",\n            \"svn_url\": \"https://github.com/developer-guy/goreleaser-slsa-provenance\",\n            \"tags_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/tags\",\n            \"teams_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/teams\",\n            \"topics\": [\n              \"goreleaser\",\n              \"slsa\",\n              \"slsa-framework\",\n              \"slsa-generic-generator\",\n              \"slsa-provenance\",\n              \"slsa3\",\n              \"slsalevel3\"\n            ],\n            \"trees_url\": \"https://api.github.com/repos/developer-guy/goreleaser-slsa-provenance/git/trees{/sha}\",\n            \"updated_at\": \"2023-03-23T19:32:02Z\",\n            \"url\": \"https://github.com/developer-guy/goreleaser-slsa-provenance\",\n            \"visibility\": \"public\",\n            \"watchers\": 0,\n            \"watchers_count\": 0,\n            \"web_commit_signoff_required\": false\n          },\n          \"sender\": {\n            \"avatar_url\": \"https://avatars.githubusercontent.com/u/16693043?v=4\",\n            \"events_url\": \"https://api.github.com/users/developer-guy/events{/privacy}\",\n            \"followers_url\": \"https://api.github.com/users/developer-guy/followers\",\n            \"following_url\": \"https://api.github.com/users/developer-guy/following{/other_user}\",\n            \"gists_url\": \"https://api.github.com/users/developer-guy/gists{/gist_id}\",\n            \"gravatar_id\": \"\",\n            \"html_url\": \"https://github.com/developer-guy\",\n            \"id\": 16693043,\n            \"login\": \"developer-guy\",\n            \"node_id\": \"MDQ6VXNlcjE2NjkzMDQz\",\n            \"organizations_url\": \"https://api.github.com/users/developer-guy/orgs\",\n            \"received_events_url\": \"https://api.github.com/users/developer-guy/received_events\",\n            \"repos_url\": \"https://api.github.com/users/developer-guy/repos\",\n            \"site_admin\": false,\n            \"starred_url\": \"https://api.github.com/users/developer-guy/starred{/owner}{/repo}\",\n            \"subscriptions_url\": \"https://api.github.com/users/developer-guy/subscriptions\",\n            \"type\": \"User\",\n            \"url\": \"https://api.github.com/users/developer-guy\"\n          }\n        },\n        \"github_head_ref\": \"\",\n        \"github_ref\": \"refs/tags/v0.1.0\",\n        \"github_ref_type\": \"tag\",\n        \"github_repository_id\": \"618091561\",\n        \"github_repository_owner\": \"developer-guy\",\n        \"github_repository_owner_id\": \"16693043\",\n        \"github_run_attempt\": \"2\",\n        \"github_run_id\": \"4504563596\",\n        \"github_run_number\": \"5\",\n        \"github_sha1\": \"af2de62d809c3b5e3ccd2653f4b476a7bc968226\"\n      }\n    },\n    \"metadata\": {\n      \"buildInvocationID\": \"4504563596-2\",\n      \"completeness\": {\n        \"parameters\": true,\n        \"environment\": false,\n        \"materials\": false\n      },\n      \"reproducible\": false\n    },\n    \"materials\": [\n      {\n        \"uri\": \"git+https://github.com/developer-guy/goreleaser-slsa-provenance@refs/tags/v0.1.0\",\n        \"digest\": {\n          \"sha1\": \"af2de62d809c3b5e3ccd2653f4b476a7bc968226\"\n        }\n      }\n    ]\n  }\n}\n```\n\n\u003c/details\u003e\n\nor, you can use a fancy UI provided by the Chainguard team: `search.sigstore.dev`:\n\n\u003e _\u003chttps://search.sigstore.dev?uuid=24296fb24b8ad77a395fedaf1d422c0b839acc9a24aa5377af9163c453060d0111cfcb2120f9d02a\u003e_\n\nThen, you can verify the signature of the generated provenance file and verify the artifacts by using the following command:\n\n```bash\n$ slsa-verifier verify-artifact \\\n                    --provenance-path multiple.intoto.jsonl \\\n                    --source-uri github.com/developer-guy/gorelaser-slsa-provenance  \\\n                    --source-tag v0.1.0 \\\n                     goreleaser-slsa-provenance_Darwin_arm64.tar.gz\nVerified signature against tlog entry index 16144987 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77aa15437c51886ccc312ca822f1c67cb4c436cf79f57e1f637ed992cd162530242\nVerified build using builder https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.5.0 at commit af2de62d809c3b5e3ccd2653f4b476a7bc968226\nPASSED: Verified SLSA provenance\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoreleaser%2Fexample-slsa-provenance","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgoreleaser%2Fexample-slsa-provenance","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoreleaser%2Fexample-slsa-provenance/lists"}