Every release, signed and provable.
You run a binary you downloaded from the internet — so you should be able to prove it's really ours before you trust it. Every sporo release is signed, attested, and inventoried, and the source it's built from is continuously scanned. None of this needs an account, a key, or our servers.
Don't take our word for it — verify the binary.
Every release is signed with cosign — keyless, so there's no signing key you have to trust — and carries a SLSA build-provenance attestation binding the binary to this repository's release workflow, plus a full SBOM. Confirm what you downloaded is really ours, offline, in two commands:
# build provenance — who built it, and from which commit
$ gh attestation verify \
sporo_…_linux_amd64.tar.gz \
-R ydnikolaev/sporo
✓ built by ydnikolaev/sporo · release.yml# signature — the keyless cosign bundle over checksums
$ cosign verify-blob \
--bundle checksums.txt.sigstore.json \
checksums.txt
Verified OKFound something? Tell us privately.
Please don't open a public issue for a security problem. Use GitHub's private advisory flow — Report a vulnerability on the repository's Security tab — a channel visible only to the maintainers.
- →Acknowledgement within 3 business days; assessment and next steps within 7.
- →Supported version — only the latest release receives fixes; upgrade with
sporo upgradeand confirm it still reproduces. - →Credit in the published advisory, unless you'd rather stay anonymous.
Full policy: SECURITY.md.
We show the findings, not just the badge.
govulncheck runs on every PR and daily. A vulnerability we can't yet fix — an unmaintained transitive dependency with no patched version — is not hidden: it's recorded in a public, commented allowlist (.govulncheck-allow.txt) with the reason, so the gate stays green on the known one and loud on any new one. Same discipline as the recipe badges: a claim is only made when it's earned.