Enhancement: Add signed SLSA attestations to nightly docker builds about build HOT 4 CLOSED

Is this only related to the docker nightly images or also to the Tensorflow nightly wheels built with these images?

This would just be the docker nightly images.

Right now we can create attestations on a general hashable artifacts (which could apply to the wheels), golang binaries, and OCI artifacts. We are working to create better SLSA attestations for the python ecosystem separately, so that attestations can directly be retrieved through pip. When the Python work is feature complete, we would definitely look into adding them.

Re the issue: the aim is that slsa attestations will provide information on the config source where it was built, including the commit SHA.

from build.

Is this only related to the docker nightly images or also to the Tensorflow nightly wheels built with these images?

Cause we still don't publicly know on which specific nightly commits the nightly wheels are built. See #72

from build.

They're not really related. The wheels need a lot more work to get attestations added.

from build.

(closed by mistake on my fork)

from build.