Mitigating Attacks on Software Supply Chain Using GOSH Docker Extension
Explore GOSH Docker Extension's innovative features for securing software supply chains, including container verification, decentralized signatures, DAO governance, and automated CI/CD pipeline security.
Identity-based Source Integrity with Gitsign
Explore Gitsign, a Sigstore project for keyless, identity-based Git commit signing. Learn its benefits over traditional methods and how it enhances security in CI/CD and GitOps workflows.
Securing Software Supply Chains with In-Toto
Explore in-toto, a framework for securing software supply chains, and learn its implementation strategies for enhancing cybersecurity in software development processes.
SPDX 3.0 Update
Learn about the latest updates and improvements in SPDX 3.0, exploring its enhanced capabilities for software bill of materials (SBOM) and supply chain security.
Will Large-Scale Automated Scanning Stop Malware on OSS Repositories?
Explore challenges of automated malware scanning in open-source repositories, focusing on PyPI's experience. Learn why current approaches fall short and discover emerging solutions for effective package security.
Growing the Chain: Trusting Build Provenance from Userspace
Explore techniques for establishing trust in CI/CD workflows, focusing on artifact signing, provenance generation, and building a chain of trust using open-source technologies like Sigstore and OIDC.
Hands-on Introduction to Sigstore - Securing the Software Supply Chain
Comprehensive introduction to sigstore, covering container image signing, keyless mode, transparency logs, and image policy enforcement with Kyverno for enhanced software supply chain security.
Drivers for Software Supply Chain Security Programs
Explore software supply chain security concerns, drivers, and strategies based on a survey of 300 tech executives. Gain insights into current issues and learn programmatic approaches to address risks.
Lessons Learned Building a Software Supply Chain Security Team
Insights on building a software supply chain security function, exploring the role of SBOMs and addressing challenges in implementing effective security measures.
Snow Nor Rain Nor Dependency Confusion - How to Deliver the Right Package
Practical insights on identifying, exploiting, and fixing dependency confusion vulnerabilities in real-world package environments, based on firsthand experience.
A Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain Security
Explore popular supply chain security ingredients and learn how to combine them effectively to address threats in your organization's ecosystem.
The Current State of Open Source Security Compliance Tooling Is Well, Sad
Explore practical approaches to improve software supply chain security using OpenSSF projects, open source tools, and open data for automated compliance and robust processes.
Automated End-to-End VEX Streams You Can Trust
Explore automated VEX streams for trusted vulnerability communication. Learn to build end-to-end systems using OpenVEX, enhancing software security without human intervention.
Cryptographic Governance - Software Supply Chain Security with CBOM
Explore software supply chain security using Cryptographic Bill of Materials (CBOM) for enhanced governance and risk mitigation in development processes.
OWASP Dependency Track - Fortifying the Software Supply Chain
Explore strategies to secure software supply chains using OWASP Dependency Track, a powerful tool for identifying and mitigating vulnerabilities in third-party components.
The Internet is Broken: Breaking Down the Software Supply Chain
Explore modern software vulnerabilities, recent supply chain attacks, and actionable steps to build secure applications in an insecure internet environment.
An Introduction to Sigstore for Pythonistas
Explore Sigstore for securing Python projects: learn to sign, verify, and protect software artifacts, addressing supply chain vulnerabilities with accessible tracing methods.
Securing the Supply Chain: A Practical Guide to SLSA Compliance from Build to Runtime
Practical guide to securing software supply chain using CNCF tools. Covers SLSA compliance, GitHub Actions, Cosign, Kyverno, in-toto, and Kubescape for build-to-runtime security in Kubernetes ecosystems.
Securing the Software Supply Chain - SBOMs and Their Impact
Explore software supply chain security, SBOMs, and their impact on open source. Learn about transparency challenges and the potential effects of the Cyber Resilience Act.
Reproducible Builds with BuildKit for Software Supply Chain Security
Learn how BuildKit enables reproducible builds to enhance software supply chain security, ensuring verifiable and trustworthy Docker images through bit-for-bit identical reproduction from source code.
Introducing OpenChain Japan Community's SBOM Initiatives
Explore Japan's SBOM initiatives, SPDX 3.0 contributions, and future outlook. Gain insights on software supply chain security, practical SBOM adoption, and global implications for stakeholders.