Pooja Bolla·7h agoSoftware Supply Chain Security on Kubernetes, Part 3: Enforcing Signatures and SBOM Attestations…How I got the cluster to refuse unsigned or unscanned images with one Kyverno policy, the attacks it stopped in my lab, and the failure…
Pooja Bolla·3d agoSoftware Supply Chain Security on Kubernetes, Part 1: Signing Container Images with CosignHow I sign and verify container images with Cosign v3, so I can prove the image running in the cluster is the one our pipeline built.
HIDOURI Bellkis·Oct 5Supply-Chain — Container Image Signing on AKS with Cosign and KyvernoWhy sign images at all
Zero CVE Club·Sep 25What Is Software Supply Chain Security?Software supply chain security means controlling what enters your build and proving what leaves it. Sonatype counted 454,600 new malicious…
Gunjan Mehta·Sep 24You Already Use TUF. You Just Don’t Know Where.Nine places The Update Framework protects a SaaS stack, and the one place you have to build it yourself
Anitha Natarajan·Sep 1Running Red Hat Trusted Artifact Signer on kind ClusterBuild the operator from source, stand up your own Sigstore on one node, and sign a real image
Thanos Katsaounis·Jun 29I Built a CI/CD Pipeline That Refuses to Run Code It Can’t Prove It BuiltYour tests are green. The image is in the registry. It’s running in production. And almost nobody can answer one question with any…
InDev GeniusbyDamini Bansal·Jun 17Sigstore — Let’s Encrypt, But for Code SigningIn March 2024, a backdoor was discovered in XZ Utils — a compression library installed on virtually every Linux system on earth. A…
Kawaldeep Singh·Feb 20Practical Software Supply-Chain Security (2026): SBOMs, Signing, SLSA & Reproducible Builds — A…Modern breaches don’t usually target your app’s code — they attack the build pipeline, package registry, or CI artifacts. Fixing that…
InSopra Steria NorgebyAlexei Ivanov·Jan 26YAHT: Configuring Sigstore Policy Controller for Openshift Service Mesh 3 Gateway injection.BackgroundA response icon1A response icon1
