Installation
There are five supported ways to get CI/lock running.
Verify the `cilock` binary
Two working verification paths for a downloaded cilock — SHA-256 integrity against the signed manifest, and full SLSA provenance verification against the platform-signed release policy using the DSSE envelopes published beside every binary on cilock.dev.
Your first attestation
Intro
Connect to the platform
Your first attestation signed and verified evidence entirely on your laptop with a local key. That's the whole loop, offline. Connecting to the TestifySec platform adds three things a local key can't:
CI quickstart
The fastest path from a vanilla GitHub Actions workflow to signed evidence. This page shows one copy-pasteable workflow that produces a signed attestation around a single build step, then points to the dropbox-clone reference for the fuller multi-step pattern.
Verify SLSA provenance offline (air-gapped, no platform)
Verify a downloaded CI/lock binary FULLY OFFLINE — using only the DSSE attestation envelopes, Fulcio + Root CA, and RFC 3161 TSA chain published alongside the binary on cilock.dev. No TestifySec platform, tenant, or Archivista access required. For air-gapped and zero-trust verifiers.