OSPS-BR-06 Include Signatures and Hashes With Release (maturity levels 2, 3). Requirement: When an official release is created, that release MUST be signed or accounted for in a signed manifest including each asset's cryptographic hashes. Objective of the control: Ensure released software assets can be verified by users to ensure integrity of each asset when it is used. Recommendation: Sign all released software assets at build time with a cryptographic signature or attestations, such as GPG or PGP signature, Sigstore signatures, SLSA provenance, or SLSA VSAs. Include the cryptographic hashes of each asset in a signed manifest or metadata file.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.