Back to browse
GitHub Repository

Experimental, do not use

5 starsGo

Portcullis, a review gate for curl|bash

by ImJasonH·Apr 2, 2026·5 points·1 comment

AI Analysis

●●SolidBig BrainNiche Gem

Sigstore-backed trust gate for curl|bash pipelines before execution.

Strengths
  • Leverages Sigstore Rekor for decentralized trust attestations without central authority.
  • Syntax validation and binary detection before allowing script execution.
  • Local cache with 24h TTL reduces repeated Rekor queries.
Weaknesses
  • Chicken-egg problem: first user must manually attest before others benefit.
  • README explicitly says 'Experimental, do not use' limiting production adoption.
Category
Target Audience

DevOps engineers, security-conscious developers

Similar To

Sigstore · cosign · asdf

Similar Projects