Skip to main content

Does Sigstore Really Secure The Supply Chain?

 Linux Foundation's answer to supply chain attacks is to offer a free code signing service for open source developers, called Sigstore. While on the right track it does not  mitigate all supply chain hazards.The truth is that it's not possible to completely do so.

sigstore-logo

To build useful software we don't reinvent the wheel but we base on work already done coming bundled in the form of libraries.
The problem is that even a mediocre open source project can have loads of such dependencies which themselves depend on others, forming a length chain.Not a problem per se unless you aim implanting malicious code anywhere in this chain. After all it takes just one command:

fuul article on i-programmer

Labels:

Comments

Post a Comment

Popular posts from this blog

Open Source Is Not Just About Software

  It's about infrastructure as well, something that although not attracting the limelight, is as important as the open source software it hosts. Today the stewards of the largest open source registries in the world have issued an open letter demanding urgent reform in how open source infrastructure is funded, maintained, and operated.  https://www.i-programmer.info/news/136-open-source/18334-open-source-is-not-just-about-software.html
Post a Comment
Read more

Europe Gets Its Own LLM

  EuroLLM is a fully open-sourced large language model made in Europe and built to support all twenty-four official EU languages. While several European states have separately produced their own LLMs, such as Greece's "Meltemi" or the recent offering from Switzerland "Apertus", there was no solution that catered for the languages of all 24 states belonging to the EU block. The time has come for this status to change with the appearance of EuroLLM, a foundational model that supports them all. https://www.i-programmer.info/news/105-artificial-intelligence/18448-europe-gets-its-own-llm.html
Post a Comment
Read more

With MCP Docs Servers You'll Never Run Out Of Fresh Documentation

  MCP has changed the way you interact with your tools overnight. Now it targets your documentation. Wouldn't be great to have the latest and updated code samples and documentation of your favorite framework and libraries ready at your fingertips? Plus, be able to talk to it in natural language? https://www.i-programmer.info/news/90-tools/18248-with-mcp-docs-servers-youll-never-run-out-of-fresh-documentation-.html
Post a Comment
Read more