PERL,INGRES,PROGRAMMING

  Today at DockerCon, Docker has announced the General Availability of Docker Scout. With the integration of Sysdig Runtime Insights, Docker Scout helps developers prioritize risk. This will significantly improve software supply chain security. Let's find out why. https://www.i-programmer.info/news/90-tools/16658-docker-and-sysdig-partner-up-to-secure-the-software-supply-chain.html

  It's the the one-year anniversary of Wolfi, the first community Linux undistro focused on supply chain security. A lot has happened during that year. Let's find out what. https://www.i-programmer.info/news/126-os/16637-happy-birthday-wolfi-linux-undistro.html

  Enforce, Chainguard's enterprise-ready platform for supply chain security in containerized applications gets now an upgrade to unlock some new major features that enable secure software development across each step of the software supply chain. https://www.i-programmer.info/news/149-security/16467-chainguards-enforce-platform-boosted-with-new-capabilities.html

In another attempt to secure the precious software supply chain, GitHub has released a new Export SBOM functionality which generates an NTIA-compliant software bills of materials (SBOMs) on demand. The supply chain security aspect aside, this feature will also make it easier for software providers to comply with the US Executive Order 14028 on improving the nation’s cybersecurity, which introduced the requirements of providing SBOMs. full article on i-programmer: https://www.i-programmer.info/news/90-tools/16198-github-provides-self-service-sboms.html 

  sigstore-java, currently under development but not yet ready for general-purpose use,  is a tool for signing and verifying Java package distributions with Sigstore's keyless signing. This is one more step taken by Sigstore towards securing the software supply chain. Sigstore signing empowers software developers to securely sign software artifacts such as release files, container images and binaries. These signatures are then stored in a tamper-proof public log - for free. full article on i-programmer: https://www.i-programmer.info/news/80-java/16176-sigstore-java-sign-and-verify-your-java-builds.html

Chainguard, the co-creator of Sigstore, has conducted a survey to better understand if and how software supply best practices are utilized by the industry. We take a look at the findings. With the title,  SLSA++ A Survey of Software Supply Chain Security , it was actually run by a consortium comprising  Chainguard, the Eclipse Foundation, the Rust Foundation and the OpenSSF. Suffice to say that these resounding names put some weight behind it. It tried to address the following questions:  Is everyone doing software supply chain security, or is everyone just talking about software supply chain security? Do software professionals actually think different software supply chain practices are helpful, easy or difficult?  full article : https://www.i-programmer.info/news/149-security/16161-surveying-software-supply-chain-security.html

 With all that effort being put as well as the recent service's GA, consumers of OSS should start feeling much much safer full article on i-programmer: https://www.i-programmer.info/news/149-security/15821-sigstore-reaches-general-availability.html

 Chainguard, the co-creator of Sigstore, has just launched Wolfi, a community Linux (un)distribution that is built with the default security measures necessary for securing the software supply chain. wolfi1 The push for software supply chain integrity and transparency has left organizations struggling to build in software security measures like signatures, provenance, and SBOMs to legacy systems and existing Linux distributions. To that end, Sigstore is good but requires manual labor. There must be a better way of utilizing its facilities. And what better than package all the work in an immutable container? Chainguard’s new Linux (un)distribution and build toolchain, Wolfi, is doing exactly that. It produces container images that meet the requirements of the secure software supply chain; that is images already provided with signing and sensible defaults. Sensible defaults is certainly an answer to writing secure code. I discussed this notion when covering Semgrep, a tool that searc...

 A new course  from the Linux Foundation on the edX platform  aims to educate the industry on how to digitally sign software artifacts. Targeted at both software developers and DevOps and security engineers, it focuses on using the Sigstore toolkit to secure the software supply chain.  Sigstore is really upping its game. Supporting new tools, like GitSign which I recently covered, it produces announcements, consortiums and educational material. It really is taking supply chain security seriously. For those still not aware of the concept, the desired outcome is to protect the software supply chain. How can this be achieved? full article on i-programmer: https://www.i-programmer.info/news/150-training-a-education/15617-securing-your-software-supply-chain-with-this-free-course.html

 Sigstore and the Linux Foundation have taken another step toward securing the software supply chain, this time focusing on the initial stage of the chain. That is, the signing of Git commits. Supply chain security is all the rage right now and the Linux Foundation's answer to it came through Sigstore: full article on i-programmer: https://www.i-programmer.info/news/149-security/15583-protect-the-software-supply-chain-with-gitsign.html

  Open Source Insights is a new project by Google that helps developers understand and visualize their applications' dependencies and therefore the vulnerabilities that come with them. Supply chain security is all the rage right now. We've taken a look at the implications as well as the ways of mitigation in " Does Sigstore Really Secure The Supply Chain? " the Linux Foundation's answer to supply chain attacks: full article on i-programmer.info