marcus/job-chainguard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix framing: Speckl complements Sigstore (upstream of build), not extends it

Browse source
This commit is contained in:
sscoble 2026-07-08 00:53:45 -07:00
parent c16129ce7f
commit 92a039b0cc
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -6,7 +6,7 @@
## 1. Why Chainguard ## 1. Why Chainguard
Chainguard's product is the canonical dark-factory: supply-chain attacks where a poisoned upstream package reaches production and the human is *not in the loop*. Their internal "Chainguard Factory" builds OSS artifacts at SLSA L3 — "every line is verified, hardened, and traceable" by construction — which is the literal Speckl thesis at artifact scale. The Speckl × Chainguard demo (Kafka KRaft provenance compile) demonstrates intent-level provenance that *complements* Chainguard's artifact-level provenance, not competes with it. Co-founder Dan Lorenc co-founded Sigstore, making this the only company on the shortlist where the founder's tagline is structurally congruent with Scott's. Chainguard's product is the canonical dark-factory: supply-chain attacks where a poisoned upstream package reaches production and the human is *not in the loop*. Their internal "Chainguard Factory" builds OSS artifacts at SLSA L3 — "every line is verified, hardened, and traceable" by construction — which is the literal Speckl thesis at artifact scale. Speckl is a **complement** to Sigstore, not an extension: Speckl is upstream of the build (specifies what should exist, with what constraints); Sigstore attests to the build output (what was actually built, signed, attested). The two stack — Speckl adds *intent provenance* (the spec the artifact was generated from) on top of Factory 2.0's existing SLSA L3 artifact provenance. Co-founder Dan Lorenc co-founded Sigstore, making this the only company on the shortlist where the founder's tagline is structurally congruent with Scott's.
## 2. JD snapshot ## 2. JD snapshot
@ -80,7 +80,7 @@ Chainguard's product is the canonical dark-factory: supply-chain attacks where a
### Premise ### Premise
The Speckl × Chainguard demo is a Kafka KRaft provenance compile that demonstrates intent-level provenance at the build layer — complementing Chainguard's artifact-level SLSA L3 provenance. The artifact proves Scott can build the thing that extends what Chainguard ships. The Speckl × Chainguard demo is a Kafka KRaft provenance compile that demonstrates intent-level provenance at the build layer — complementing Chainguard's artifact-level SLSA L3 provenance. Speckl is upstream of the build (the spec the artifact was generated from); Sigstore attests to the build output. The two stack. The artifact proves Scott can build the thing that composes with what Chainguard ships.
### Repo layout ### Repo layout