Installation
There are five supported ways to get CI/lock running.
Verify the `cilock` binary
Two working verification paths for a downloaded cilock — SHA-256 integrity against the release manifest, and full SLSA provenance verification against the platform-signed release policy using the DSSE envelopes published beside every binary on cilock.dev. macOS and Windows binaries are not OS-signed; Path 2 is how to check them.
Your first attestation
Intro
Connect to the platform
Your first attestation signed and verified evidence entirely on your laptop with a local key. That's the whole loop, offline. Connecting to the TestifySec platform adds three things a local key can't:
CI quickstart
The fastest path from a vanilla GitHub Actions workflow to signed evidence. This page shows one copy-pasteable workflow that produces a signed attestation around a single build step, then points to the dropbox-clone reference for the fuller multi-step pattern.
Verify SLSA provenance offline (air-gapped, no platform)
Verify a downloaded CI/lock binary FULLY OFFLINE — using only the DSSE attestation envelopes, Fulcio + Root CA, and RFC 3161 TSA chain published alongside the binary on cilock.dev. No TestifySec platform, tenant, or Archivista access required. For air-gapped and zero-trust verifiers.