Tag archive
Software supply chain attacks cost $80.6 billion annually. How SBOMs, Sigstore keyless signing, SLSA build integrity, and Kubernetes admission controllers build multi-layered protection – and why the
When a rogue container slips into production, the fallout can be catastrophic. Discover how build signing and Sigstore lock down your CI/CD chain, giving attack
The Cilium project's third post in its CI/CD hardening series walks through how it manages credentials and verifies what it ships, then lists the parts it has not fixed yet. The unusual move is publishing the unfinished work.
Complete guide to securing your Kubernetes supply chain from Git commit to cluster runtime. Learn Sigstore, Cosign, SBOMs, SLSA framework, and admissi
Originally published at norvik.tech Introduction Explore how stolen credentials...
In 2024, the average enterprise leaked 12,000+ secrets through misconfigured CI pipelines, hardcoded...
In 2024, 82% of supply chain attacks targeted unsigned container images and unverified dependencies,...
After SBOM and Cosign comes Provenance. Issue SLSA Build L3 provenance with slsa-github-generator and verify it with slsa-verifier, end to end on real machines.
Why did Docker Content Trust (Notary v1) fail, and how did the industry pivot to Sigstore and Notary v2? A timeline of container signing architecture, contrasted with PyPI's success story.
SOPS vs Sigstore: Revolutionize Container Scanning in Production Containerized workloads...
We Ditched Sigstore 1.9 for Cosign 2.0: Here's Why We Switched Back Last quarter, our...
On March 12, 2024, at 14:17 UTC, Sigstore’s root key monitoring system fired a P0 alert that would...