Marco Franssen • 4/1/2022

OCI as attestations storage for your packages

Read Original

This technical article details a method for securing the software supply chain by storing Software Bill of Materials (SBOM) and build provenance attestations in OCI registries for packages like npm, Maven, or NuGet. It demonstrates using Sigstore's Cosign to upload and sign these artifacts, providing a workaround for better security and transparency until native package manager integration is available.

0 comments
#Software Supply Chain Security #Sbom #Oci Registry
OCI as attestations storage for your packages

Comments

No comments yet

Be the first to share your thoughts!

Browser Extension

Get instant access to AllDevBlogs from your browser

Top of the Week

1
React vs Browser APIs (Mental Model)
Jivbcoop • 3 votes
2
React, useEffect, and Stale Closures: How to Avoid Them with Dependencies and useRef
Jivbcoop • 2 votes
3
Building Type-Safe Compound Components
TkDodo Dominik Dorfmeister • 2 votes
4
Using Browser Apis In React Practical Guide
Jivbcoop • 1 votes
5
Better react-hook-form Smart Form Components
Maarten Hus • 1 votes
6
Introducing RSC Explorer
Dan Abramov • 1 votes
7
The Pulse: Cloudflare’s latest outage proves dangers of global configuration changes (again)
The Pragmatic Engineer Gergely Orosz • 1 votes