{"id":13846545,"url":"https://github.com/kubernetes-sigs/tejolote","last_synced_at":"2026-04-06T09:01:26.579Z","repository":{"id":47595302,"uuid":"512269998","full_name":"kubernetes-sigs/tejolote","owner":"kubernetes-sigs","description":"A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.","archived":false,"fork":false,"pushed_at":"2026-04-01T13:58:17.000Z","size":2593,"stargazers_count":72,"open_issues_count":1,"forks_count":12,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-04-01T15:26:40.586Z","etag":null,"topics":["attestation","provenance","sbom","sigstore","slsa"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kubernetes-sigs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"code-of-conduct.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":".github/SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-07-09T19:32:59.000Z","updated_at":"2026-04-01T13:58:22.000Z","dependencies_parsed_at":"2026-04-06T09:00:55.783Z","dependency_job_id":null,"html_url":"https://github.com/kubernetes-sigs/tejolote","commit_stats":null,"previous_names":[],"tags_count":14,"template":false,"template_full_name":null,"purl":"pkg:github/kubernetes-sigs/tejolote","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes-sigs%2Ftejolote","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes-sigs%2Ftejolote/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes-sigs%2Ftejolote/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes-sigs%2Ftejolote/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kubernetes-sigs","download_url":"https://codeload.github.com/kubernetes-sigs/tejolote/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes-sigs%2Ftejolote/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31466228,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-06T08:36:52.050Z","status":"ssl_error","status_checked_at":"2026-04-06T08:36:51.267Z","response_time":112,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attestation","provenance","sbom","sigstore","slsa"],"created_at":"2024-08-04T18:00:39.475Z","updated_at":"2026-04-06T09:01:26.538Z","avatar_url":"https://github.com/kubernetes-sigs.png","language":"Go","funding_links":[],"categories":["Software Bill of Materials"],"sub_categories":[],"readme":"# tejolote\n\nA highly configurable build executor and observer designed to generate \nsigned [SLSA](https://slsa.dev/) provenance attestations about build runs.\n\n## What Does That Mean!?\n\n![SLSA Logo](docs/slsa-logo.png)\n\nIf you are not familiar with\n[provenance](https://www.tiktok.com/@chainguard_dev/video/7133203786927050027) attestations, think of them as non-falsifiable documents that inform you\nusers how software was built, mainly:\n\nWhat went in → What was done to the source code (and by who) → what came out.\n\nA provenance attestation provides users with full transparency to the\nbuild process of the software they consume, allowing them to know where\nit came from, how it was built and by who.\n\n## Key Features\n\nTejolote is designed to observe build systems as they run to gather data\nabout transformations done to software as it goes through the build process.\nIt features a pluggable model to add more build systems and artifact\nstorage as the need arises.\n\n* Support for multiple build systems (currently \n[Google Cloud Build](https://cloud.google.com/build), \n[Github Actions](https://github.com/features/actions), \n[Prow](https://github.com/kubernetes/test-infra/tree/master/prow) \ncoming soon).\n* Support for gathering attestation data in multiple stages or observing a build\nwhile it runs.\n* Collection of artifacts from different sources (build system native, \ndirectories, OCI registries, Google Cloud Storage buckets).\n* Attestation signing using [sigstore](https://sigstore.dev)\n* Attaching attestations to container images as cosign\n\n## Operational Model\n\nTejolote watches your build system build (or transform) your software\nproject. It treats your build as a black box and makes no assumptions as\nto the security of the build itself.\n\nIt will trust the inputs you tell it to consider and the artifacts your\nbuild produces by looking a the location you instruct it too look for them. \n\n```mermaid\nflowchart LR\n\n subgraph Build System\n   direction LR\n   clone(\"Clone Repository\") --\u003e build(Run Build) --\u003e publish(Publish Artifacts)\n   fetch(\"Fetch Materials\") --\u003e build\n   publish --\u003e oci(Container Registry)\n   publish --\u003e gcs(GCS Bucket)\n   publish --\u003e file(Filesystem)\nend\nsubgraph Tejolote\n  direction LR\n  watch(Watch Build System) --\u003e attest(Attest) --\u003e sign(Sign)\nwatch-. RECORD .-o clone\nwatch-. RECORD .-o fetch\nwatch-. CONTINOUSLY OBSERVE .-o build\nwatch-. COLLECT .-o publish\nend\n\n```\n\nWhile build systems can themselves provide information about the\nartifacts produced after a run, Tejolote sits one level above and\nwill expect artifacts to appear in the storage location(s) you\ntell it to monitor.\n\n## Example\n\nLet's say for example you want to attest a Cloud Build job that produces\na bunch of binaries in a GCS bucket. In this case, the gcb project is\n`example-project` and artifacts are uploaded to the bucket `test-bucket`\nin the directory `/test`:\n\n```bash\ntejolote attest \\\n   gcb://kubernetes-release-test/3190d867-f2e5-4969-aafd-0117b6c8ed12 \\\n   --artifacts=gs://ulabs-cloud-tests/test/\n```\n\nThese are made up examples, but Tejolote would produce an attestation\nsimilar to this:\n\n```json\n{\n  \"_type\": \"https://in-toto.io/Statement/v0.1\",\n  \"predicateType\": \"https://slsa.dev/provenance/v0.2\",\n  \"subject\": [\n    {\n      \"name\": \"gs://ulabs-cloud-tests/test/bom-windows-amd64.exe\",\n      \"digest\": {\n        \"sha256\": \"c03c50f220b095bf52a0ca496989a6c07f198d03cb8aad19834df143625ee821\"\n      }\n    }\n  ],\n  \"predicate\": {\n    \"builder\": {\n      \"id\": \"\"\n    },\n    \"buildType\": \"https://cloudbuild.googleapis.com/CloudBuildYaml@v1\",\n    \"invocation\": {\n      \"configSource\": {}\n    },\n    \"buildConfig\": {\n      \"steps\": [\n        {\n          \"image\": \"gcr.io/cloud-builders/git\",\n          \"arguments\": [\n            \"clone\",\n            \"https://github.com/kubernetes/release\"\n          ]\n        },\n...\n```\n\nBoth build system runs and artifact repositories are specified by using\n[spec urls](docs/spec-urls.md) that point to the specific runs and storage\nlocation. Check out the \n\n## What's with the name?\n\nTejolote /ˌteɪhəˈloʊteɪ/ : From the nahua word _texolotl_. \n\n![molcajete and tejolote](docs/molcajete.jpg)\n\nA tejolote is the handle of the [_molcajete_](https://en.wikipedia.org/wiki/Molcajete), the prehispanic mortar used to make \nsalsa.\n\nSo, the idea is to use tejolote to get some salsa out of your project :)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubernetes-sigs%2Ftejolote","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkubernetes-sigs%2Ftejolote","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubernetes-sigs%2Ftejolote/lists"}