SLSA BD.2: Publish attestations where consumers can get them

What does BD.2 require?

Every producer must put its attestations in one or more places, ideally several: alongside source repository releases where the host offers a release feature; alongside the artifact in the package registry as a one-to-one sidecar file; and elsewhere with a hash and pointer recorded in an external transparency log (such as Rekor) that sits outside both the repository and the registry. Over time package registries should accept and serve provenance with the artifact, which keeps trust and reliability in the service clients already depend on.