Protecting the World's Greatest Open Source Ecosystem with Sigstore
Explore Sigstore, an OpenSSF project enhancing software supply chain security. Learn to sign and verify Maven Central artifacts, protecting against malicious attacks and ensuring dependency trust.
PGP vs Sigstore - The Match at Maven Central
Exploring sigstore as an alternative to PGP for signing and verifying Maven Central artifacts, promising easier key management and improved software supply chain security.
PEP 740 and PyPI - Bootstrapping Provenance for the Python Ecosystem
Explore how PEP 740 enhances PyPI's security through digital attestations, integrating with Sigstore and SLSA to provide robust package provenance without complex key management.
Open Source Software Supply Chain Security - Understanding Threats and Best Practices
Explore critical threats to open source software supply chains, industry best practices for security, and practical strategies for protecting against vulnerabilities and cyberattacks.
Essential Security Checks for Your Go Project
Implement essential security checks in Go projects using open-source tools like gosec, govulncheck, and sigstore/cosign. Learn to integrate code analysis, vulnerability scanning, and supply chain security.
Securing Your Supply Chain with an Open Source Ecosystem
Explore open-source tools and best practices for securing software supply chains across creation, build, deployment, and runtime stages. Learn to leverage automation and DevSecOps to reduce vulnerabilities.
Practical Guides for Enhancing Your Software Supply Chain Security
Practical guide to fortify software supply chain security using open-source tools. Covers building, packaging, dependencies, code scanning, and establishing trust across the delivery process.
CRI-O Features for Fun and Profit - Advanced Kubernetes Container Runtime Capabilities
Discover cutting-edge CRI-O and Kubernetes features, from sigstore signature support to Podman pod integration and OCI artifacts, designed for cluster admins seeking advanced container runtime capabilities.
Community-centric Approaches to Securing AI-generated Code
Explore community-driven strategies for securing AI-generated code, focusing on proof of origin, safe mergeability, and protecting against security risks in AI coding assistants.