Build provenance attestation for Windows
Open
@shivammathur is already working on this.
Since Mar 27, 2026.
Feature
OS: Windows
Status: Verified
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
As part of our software security policy, we are looking to validate the authenticity of PHP Windows builds using Cosign.
Are there any public certificates or attestations available for these artifacts? This is a prerequisite for our next deployment phase, which involves systematic SBOM verification.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.