Get the latest tech news
Software Supply Chain Security
Terms
In this article, I will outline the major players in the software supply chain security ecosystem, including frameworks, standardization, and tools. It uses a protocol similar to ACME (used by Let’s Encrypt) to authenticate developers through OIDC, uses TUF as the root of trust, and issues ephemeral certificates. Cosign is part of Sigstore; it serves as a tool for signing and verifying container images, simplifying the process of applying and validating cryptographic signatures.
Or read this on Hacker News