Securing the IaC Supply Chain
Explore securing Infrastructure as Code supply chains, applying software security principles to IaC pipelines. Learn about Crossplane's integration with Sigstore for enhanced provenance and attestations.
Zero Trust Workload Identity in Kubernetes
Explore Zero Trust principles in Kubernetes using SIFFE and Spire for workload identity-based authorization, eliminating the need for secrets and enhancing security across service meshes.
Spicing up Container Image Security with SLSA and GUAC
Explore SLSA and GUAC tools to enhance container image security, verify build provenance, and understand artifact composition for safer deployments in production environments.
Enforcing a Secure Supply Chain on Kubernetes
Explore implementing and enforcing a secure supply chain in Kubernetes using open-source projects, including Sigstore keyless workflow and signature verification policies.
Securing Your Infrastructure as Code Pipeline
Explore techniques for securing Infrastructure as Code pipelines, including static analysis, RBAC, and open-source tools like Open Policy Agent and Sigstore, to enhance productivity and compliance.
CRI-O's Graduation Celebration - Container Runtime Interface Overview and Future Plans
Explore CRI-O's CNCF graduation, architecture, and recent enhancements. Learn about its role as a stable, pluggable container runtime for Kubernetes and future project plans.
Open Tools for Secure Supply Chains in Kubernetes - From Release Engineering
Explore open-source tools for secure software supply chains, focusing on Kubernetes' journey to SLSA Level 3 compliance and how other projects can leverage these tools for enhanced security.
Demystify Modern Signing: Keys, Certificates, and Envelopes
Explore practical aspects of cryptographic signing tools, covering key algorithms, signing envelopes, certificates, and verification, with a focus on identity-based signing using short-lived keys.
NPM and Sigstore - Provenance Comes to the World's Largest OSS Ecosystem
Explore GitHub's efforts to secure the Javascript ecosystem through provenance integration and Sigstore partnership, enhancing npm's security against malware and supply chain attacks.
SLSA, SigStore, SBOM & Software Supply Chain Security - What Does It All Mean?
Demystifying software supply chain security: SLSA, SigStore, and SBOM explained. Learn about tools and methodologies to secure software from development to production in this comprehensive overview.
Securing the Open Source Software Supply Chain
Explore tools and best practices for securing the open-source software supply chain, addressing vulnerabilities, and enhancing trust in the ecosystem. Learn about recent developments and future improvements.
Ergonomic Codesigning for the Python Ecosystem with Sigstore
Explore Sigstore's integration into Python packaging, covering cryptographic fundamentals, security models, and the benefits of codesigning without long-term key material for developers and users.
Cloud Native Supply Chain Security with Tekton and Sigstore
Hands-on overview of creating a secure zero-trust supply chain on Kubernetes using Tekton, Tekton Chains, and sigstore. Learn to protect pipelines, generate provenance, and integrate with In-Toto and SPIRE.
State of the Art Supply Chain Security - In-toto, TUF, and SigStore
Explore cutting-edge supply chain security with in-toto, TUF, and SigStore. Learn how these tools create a transparent, hack-proof system to protect software from developer to end-user.
Trojan Model Hubs: Hacking the ML Supply Chain and Defending Against Model Serialization Attacks
Discover essential strategies for protecting ML systems from supply chain attacks, focusing on model scanning and cryptographic signing to defend against Model Serialization Attacks in public model hubs.
From Cosign to an Ecosystem - The Evolution of Sigstore
Explore the evolution of Sigstore's software security ecosystem, from its core components to advanced integrations for package managers, CI workflows, and policy enforcement tools.
Trojan Model Hubs - Hacking the ML Supply Chain and Defending Against Security Threats
Discover essential security strategies for ML model hubs, focusing on detecting Model Serialization Attacks and implementing cryptographic signing to protect against compromised artifacts and system vulnerabilities.
Exploring Essential Security Checks for Open Source Go Projects
Discover essential security tools for Go projects: gosec, govulncheck, and sigstore/cosign. Learn to enhance code security, scan vulnerabilities, and secure the supply chain.
Protecting Kubernetes Resource Manifests in End-to-End Software Development Lifecycle
Secure Kubernetes manifests throughout the software development lifecycle. Learn about integrity protection, signing techniques, and end-to-end supply chain security.
Fuzzing Rekor for Bugs and Vulnerabilities
Explore fuzzing techniques for Rekor, Sigstore's transparency log. Learn about challenges, artifact types, and results from months of testing. Gain insights on third-party security research approaches.
Trusted Publishing: Lessons from PyPI
Explore PyPI's trusted publishing scheme, its OpenID Connect-based authentication, and implementation details. Learn about security improvements and potential applications for other package indices.