Skill UI

This guide details the implementation of GCP Binary Authorization, a crucial deploy-time security control. It ensures that only trusted, verified container images are deployed on GKE or Cloud Run by requiring cryptographic attestations. Learn how to set up KMS-backed attestors, configure policies, and integrate the validation process into your CI/CD pipeline to enforce robust supply chain integrity.

Cosign is a powerful Sigstore tool designed to secure container images and OCI artifacts. It allows users to sign and verify image provenance using both traditional key-based methods and modern, keyless OIDC workflows. This skill covers generating signatures, attaching critical metadata like SBOM and SLSA attestations, and implementing admission controls for robust supply chain security.

A comprehensive guide for implementing hardware-level confidential computing using AWS Nitro Enclaves. This process involves creating secure enclave images (EIFs), performing cryptographic attestation validation against the Nitro PKI, and configuring AWS KMS policies. It ensures that sensitive data (like PII or PHI) remains isolated from the parent EC2 instance, guaranteeing security even if the host system is compromised.

This skill guides developers on implementing Firebase App Check in Flutter applications to secure backend access. It covers configuring attestation providers for Android, iOS, and Web, setting up debug tokens for testing, and enabling enforcement to prevent unauthorized access. Best practices for security rollout and token management are also included.

This skill provides a comprehensive workflow for verifying the integrity of a system's boot chain using TPM 2.0. It covers local validation by reading Platform Configuration Registers (PCRs) and replaying the event log, and remote attestation by generating and checking signed quotes. Use cases include enforcing Zero Trust device posture, detecting firmware tampering, or establishing secure secret baselines.

This comprehensive tool provides a multi-stage verification pipeline for the RuView system. It executes full Rust workspace tests, runs a deterministic Python proof (Trust Kill Switch) to detect behavioral drift, and generates a detailed ADR-028 witness bundle. Use this before merging pull requests or when creating an official attestation package for recipients.

Secure AI model supply chains with artifact signing, provenance attestation, SBOM generation, dependency controls, and trusted model promotion. Use for verifying model integrity, meeting SLSA/SOC2 compliance, and protecting against tampering and compromised dependencies.

Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases.