Immutable Transparency Logs with Sigstore Rekor
Sign and log an artifact in Sigstore's public Rekor transparency log with rekor-cli, verify it, then run your own Rekor server with Docker Compose.
Topic
DevSecOps
Software supply chain security: SBOMs, Sigstore signing, vulnerability scanning, secret detection and secure development.
Sign Software Artifacts with Sigstore Cosign
A step-by-step guide on signing code and software artifacts with Sigstore Cosign.
The Muggles Guide to Software Supply Chain Security
The muggles guide to software supply chain security, a short compendium.
Generate SBOMs for Container Images using Syft
A brief on generating SBOMs (software bill of materials) for container images using Syft.
What is SBOM?
A brief on software bill of materials, or SBOM, and why it is important to software supply chain security.
What is Sigstore?
A brief on sigstore - a new approach for signing, verifying and protecting software.
NIST SP 800-218: Secure Software Development Framework
A gist of the NIST SP 800-218 publication on Secure Software Development Framework.
Detect Leaked Secrets with TruffleHog
A brief guide on detecting leaked secrets using open-source Trufflehog.
Container Vulnerability Scanning with Trivy
A brief on container vulnerability scanning with open source Trivy.
15 Things I Learnt from Google on Shifting Left in Security
Google’s white paper on shifting left in security offers high-signal insights that you can adopt today.