Supply Chain Security
7 items tagged with "supply-chain-security"
Best Practices5
Supply-chain Levels for Software Artifacts (SLSA)
End-to-end integrity guarantees for software supply-chain; defines levels 1-4.
Sigstore Keyless Signing
An open standard for signing software artifacts using short-lived certificates tied to identity, removing the burden of managing long-lived private keys.
in-toto Supply Chain Attestation
A framework that secures the software supply chain by cryptographically verifying that each step in the build and release process was performed as intended.
Artifact Repository Management
The practice of storing, versioning, and governing build artifacts and dependencies in a dedicated repository so the same trusted binary is promoted from build to production.
Reproducible Builds
A set of practices ensuring a given source plus build environment always produces bit-for-bit identical binaries, so anyone can independently verify what shipped.