Vigilance vs Sigstore and SLSA
Sigstore and SLSA. Signs a release and records how it was built, so you can prove it came from the build you expect.
Vigilance. Compares two releases and says what the new one can do that the old one could not.
Side by side
| Question | Sigstore and SLSA | Vigilance |
|---|---|---|
| Proves who built a release | Yes | No |
| Proves nobody swapped it in transit | Yes | No |
| Tells you what changed inside the release | No | Yes |
| Helps when the attacker is inside the build | No | Yes |
| Covers software that ships with no signature | No | Yes |
| Needs a key or an online service | Yes | No |
Which one do you need?
Use both. A signature proves who made the file. It does not tell you what the file changed. Recent supply chain attacks all shipped correctly signed.
Try it on your own software.
Show it the version you run today and the one you are about to install.