Securing the Software Supply Chain with TUF and Docker - Protecting Against Distribution Attacks
Explore secure software updates with TUF framework, focusing on key revocation, mitigating attacks, and integrating with Docker's Notary for enhanced software supply chain security.
Talking TUF: Securing Software Distribution
Explore The Update Framework (TUF) for securing software update systems. Learn how to integrate this flexible security framework to protect against vulnerabilities and enhance software distribution safety.
Improving Package Repository Security - From White Papers to Practice
Explore package repository security challenges, modern practices, and collaborative solutions for improving community repositories like PyPI and NPM.
Toto-Ally TUF: Simple Tools for a Secure Software Supply Chain
Learn to secure software supply chains using in-toto and TUF frameworks. Explore their integration, real-world applications, and new open-source tools for enhanced protection against cyber threats.
Software Supply Chain Security Case Study at Anaconda
Explore real-world experiences in securing a large-scale open-source packaging pipeline, addressing challenges, implementing solutions, and achieving positive outcomes using respected security designs.
Maintaining The Update Framework (TUF) - Insights and Contributions
Insights into maintaining The Update Framework (TUF) for secure content delivery, covering organization, implementation, and community involvement in software supply chain security.
TUF-En Up Your Signatures - Enhancing Software Distribution Security
Explore The Update Framework (TUF) for enhanced software signing and verification. Learn about its security features, integrations, and new developments for secure software distribution at scale.
No Keys? No Problem - Why You Can Trust Sigstore Signatures
Explore Sigstore's keyless code signing, its security measures, and trust mechanisms. Learn how it protects software supply chains using open principles and robust infrastructure.
Notary: State of Development and Supply Chain Security
Explore supply chain security with Notary project overview, Notary v2 updates, and ecosystem context. Learn about TUF and in-toto projects and their role in achieving security outcomes.
Securing Content Repositories with The Update Framework (TUF)
Explore secure content delivery using The Update Framework (TUF). Learn about protecting repositories, managing keys, and recovering from compromises. Discover recent developments and implementation updates.
Verifying Software Signatures with TUF and Sigstore
Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.
So You Want to Run Your Own Sigstore - Recommendations for a Secure Setup
Explore secure setups for private Sigstore instances, covering motivations, threat modeling, and operational requirements for enterprise artifact signing and verification.
Updates from The Update Framework
Explore The Update Framework's role in secure content delivery, its protection against supply chain attacks, and its evolving ecosystem with insights from TUF maintainers.
The Update Framework (TUF) Maintainer Panel: Integrations, Enhancements, and Supply Chain Security
Panel discussion on The Update Framework: insights on integrations, supply chain security, and open-source project maintenance from TUF maintainers across various implementations and organizations.
Securing Content Distribution with RSTUF, an Incubating OpenSSF Project
Explore RSTUF, an OpenSSF project for securing content distribution. Learn about its implementation, adoption by PyPI and RubyGens, and use in private repositories and Archivista for in-toto attestation storage.
TUF Joins PyPI - Securing Package Delivery with The Update Framework
Explore TUF integration with PyPI using RSTUF, addressing security challenges in package delivery and updates. Learn about PEP 458 and Warehouse implementation.
Container Security: Supply Chain, Authorization, and Runtime Protection
Explore container security: supply chain integrity, deployment authorization, and runtime protection. Experts discuss in-toto, TUF, Open Policy Agent, and container escape prevention.
Using Docker Content Trust with Kubernetes Admission Controllers to Secure Runtime
Enhance container security by implementing image signing in CI/CD pipelines and restricting Kubernetes deployments to verified images using TUF/Notary and admission controllers.
Securing the Container Supply Chain with Notary, TUF, and Gatekeeper
Explore container supply chain security using Notary, TUF, and Gatekeeper. Learn digital signature techniques and see a demo on implementing secure CI/CD processes and policy enforcement in Kubernetes clusters.
Demystify Modern Signing: Keys, Certificates, and Envelopes
Explore practical aspects of cryptographic signing tools, covering key algorithms, signing envelopes, certificates, and verification, with a focus on identity-based signing using short-lived keys.
Building the Software Supply Chain on Docker Official Images
Explore Docker's approach to securing the software supply chain, focusing on Official Images and integrating tools like SBOMs, cryptographic signing, and verification for enhanced developer security.