#sigstore

A good production image is small, non-root, has no shell, is scanned and is signed. This article covers Docker/OCI image hardening techniques together with a Cosign keyless signing workflow using GitHub OIDC.

Duy TranMay 8, 20269 min

After xz, npm typosquats and build poisoning, supply chain attacks have become the most common vector. SLSA + SBOM + Sigstore is the open trio of standards that lets you prove where, how and by whom an artifact was built.

Duy TranMay 8, 202610 min