Introducing daedalus attestation: signed provenance for every .de
SHA-256 + Ed25519 + SBOM + transparency log. The trust layer for edge distribution is here.
The software supply chain is now the dominant attack surface in 2026. After SolarWinds and the xz-utils backdoor, buyers - and regulators - want proof about what exactly is inside the artifact they are about to run. daedalus attestation gives every .de binary a signed, machine-readable guarantee of its provenance, attached at build time and verifiable at the edge with zero connectivity.
What an attestation actually is
Following the SLSA model, a software attestation is "an authenticated statement (metadata) about a software artifact." It is not marketing: it's a signed claim that a policy engine - or a device at the edge - can mechanically verify. Provenance attestations document where source code came from, what build system produced the artifact, and what dependencies were resolved, establishing a chain of custody from source to deployable artifact.
The four layers inside a .de
- SHA-256 digest - a chunky, content-addressed fingerprint of the payload and every dependency layer.
- Ed25519 signature - one signer key, embedded device-side for offline verification, as covered in our previous post.
- SBOM - a nested inventory of every component, version, and license, in both SPDX and CycloneDX shapes, so the answer to "what's in this bin?" is never a guess.
- Transparency log - an append-only record of every signer and artifact pair, so a compromised key is caught by divergence, not by hope.
Why this maps to a real regulatory push
This is not speculative. CISA describes the SBOM as "a nested inventory, a list of ingredients that make up software components," and U.S. Executive Order 14028 defines it formally in Section 10(j) and requires vendors selling to federal agencies to provide SBOMs and attest that they follow secure development practices. The SLSA framework turns those claims into verifiable, tamper-evident attestations that compliance and audit flows can consume.
Offline is the differentiator
Most attestation tooling assumes a cloud policy engine (in-toto, Binary Authorization) that checks artifacts at deploy time online. daedalus flips it: because the SBOM, signature, and digest ship inside the .de itself, an air-gapped gateway can verify provenance locally, at the moment of install. That is what "the trust layer for edge distribution" means in practice - signed provenance that works where the cloud doesn't.