Wisec

Attestations a third party checks without a Wisec account.

What was built, from what, and where do you stand on each vulnerability?

For every build, Wisec issues a SLSA provenance and an OpenVEX document, signed, anchored on IPFS and logged in Rekor, Sigstore's public log.

SLSA Provenance v1OpenVEX v0.2.0DSSE and Rekor
1 · The artifact

What the build produced.

The subject of the provenance is the shipped file, by its SHA-256 hash, or your container images, pinned by digest. With no file declared, the source revision is what gets attested.

2 · The provenance

What went into it.

The statement lists the resolved dependencies as PURLs, and the hashes of the SBOM and of the scanner reports the agent signed. It holds no personal data.

3 · The signature

Signed, then written to the public log.

The DSSE envelope is signed with the Wisec attestation key, anchored on IPFS with a copy in storage that cannot be altered, and its hash is logged in Rekor. Rekor dates it, not us.

4 · The VEX

A stance on every vulnerability.

The VEX states, for each CVE found, whether your product is affected, not affected, fixed or under investigation. Every triage decision regenerates and re-signs it.

Under investigationNot affectedAffectedFixed
The level, stated precisely

SLSA Build L1.

The provenance is generated and signed by Wisec from what the agent reports from your CI. It is not level 2 in the strict sense, which requires provenance signed by the hosted build platform itself, nor level 3. A third party checks on its own that the attestation is intact, its date in Rekor and the artifact's hash; its content remains a statement signed by Wisec.

Without a Wisec account

What a third party checks, with standard tools.

  • Integrity. The DSSE signature covers every byte of the statement.
  • The date. The Rekor entry is timestamped by Sigstore's public log.
  • The artifact. The hash of the file received (sha256sum) must match the provenance subject.
  • Retention. The envelope is fetched by its IPFS identifier, and a copy is kept for three years in storage that cannot be altered.
The VEX

A VEX that tells the truth, and that your gate listens to.

One vulnerability

One statement.

A CVE reported by several tools is one statement, named by its CVE identifier, with its other names as aliases.

Not affected

A justification required.

The status requires one of the justifications OpenVEX defines, and every decision is written to the audit log.

The gate

What is triaged stops blocking.

A CVE declared not affected or fixed is removed from your pipeline's gate.

The certificate

One page of facts.

Every build also has its PDF certificate, with a QR code to the public verification page.

Available on the Business and Pro plans. Attestations are generated for every build, with no change to your pipeline. To name the shipped file or your images, one variable is enough.

Book a demoVerify an attestation