[SUPPLY-CHAIN] · SLSA LEVEL 3

Auths Supply Chain Shield

Hardware-Backed Commit Signing & Zero-CA Automated Provenance

Eliminate centralized Certificate Authorities. Sign developer commits with hardware keys (Secure Enclave P-256) and generate SLSA Level 3 release provenance verifiable 100% offline.

[INTERACTIVE PROTOCOL FLOW]

Supply Chain Shield Verification Flow

01
1. Git Commit Created
git commit -m "release"
Committed
02
2. Secure Enclave P-256
Biometric Key Sign
Signed P-256
03
3. CI/CD SLSA L3 Gate
GitHub Actions / Runner
SLSA L3 Pass
04
4. Verifiable Bundle
Zero-CA Offline Verify
Verified Bundle
1. Git Commit Created — Detail

Developer creates git commit locally. Auths hook intercepts commit payload.

SECURE ENCLAVE P-256 · HARDWARE ATTESTATION

Hardware-Anchored SLSA L3 Release Provenance

Eliminate centralized Certificate Authorities and vulnerable CI runner credentials. Every release binary is signed directly by maintainer hardware keys (Secure Enclave / Passkeys) and attested via in-toto SLSA Level 3 statements verifiable 100% offline.

Zero-CA Architecture In-Toto SLSA v0.2 Offline WASM Verification
CI_PROVENANCE_FLOWSLSA L3 Provenance
01Maintainer signs commit via Secure Enclave
02CI runner builds release binary artifact
03SLSA L3 in-toto statement generated
04Production gateway verifies provenance offline
[CONFIGURATION & INTEGRATION]

Hardware Commit Signing & SLSA L3

Zero-CA software supply chain security. Replace brittle certificate authorities with hardware keys and Git-native provenance.

prepare-commit-msg (Local Git Hook)
# Install Auths Git commit hook locally
auths commit-hooks install

# Automatically signs commits using Secure Enclave P-256 key
git commit -m "feat(core): implement SLSA provenance"
[HARDWARE-SIGN]

Biometric Secure Enclave

Signing keys are generated in hardware (macOS Touch ID / TPM 2.0). Keys can never be exported or leaked by malware.

[SLSA-PROVENANCE]

SLSA Level 3 Release Guard

Automatically generates cryptographically signed in-toto SLSA Level 3 statements for release artifacts.

[ZERO-CA]

Zero-CA Architecture

No reliance on central Certificate Authorities or third-party web servers. Uses Git commit graph & key event logs.

[OFFLINE-VERIFY]

Offline Browser & CLI Audit

Verifies release bundles 100% offline using WebAssembly or auths CLI without network calls.