Software supply chain security is an enormous problem: it covers everything from build systems to the code in open-source dependencies to package managers to social relationships between developers. Unfortunately, we know about hundreds of supply chain compromises, and there are likely just as many that were never discovered or reported.…
Does the psychic signature vulnerability also affect Sigstore, a code artifact signing and verification project? The short answer is NO!…
Kelsey Hightower hosted a Twitter Space on Sigstore: a new standard for signing and verifying software on March 22, 2022. The software industry has been flying blind. It's time we start signing and verifying the stuff we build and ship to the world. Join me and a few…
The recently published NIST SSDF Recommendations can seem intimidating; the good news is that the open source project Sigstore can help you and your team meet many of the recommendations.…
Past Attacks and How SLSA Helps More than a condiment or dance style, SLSA is a framework for strengthening the security of the software supply chain. SLSA, or supply-chain levels for software artifacts, provides an incremental series of defensive measures that prevents tampering and improves the integrity of a software…
If you’re worried about software supply chain attacks and unsure of how to tackle the problem or align your team on a roadmap, this series on SLSA is for you. What is SLSA?SLSA or “Supply-chain Levels for Software Artifacts” is a framework for ensuring the integrity of software…
Version 1.1 of The Secure Software Development Framework (SSDF): Recommendations for Mitigating the Risk of Software Vulnerabilities from NIST (NIST 800-218) was just published on February 3rd, 2022. The document was first released in September of 2021, but the SSDF program first started in May 2021 after Executive Order…
Congratulations to Knative on being accepted as a CNCF incubating project today! All of us at Chainguard are thrilled about this important milestone within the cloud native community. Not least our founders Matt Moore and Ville Aikas who helped create the project, and along with Scott Nichols continue to drive…