-
Based on the best practices site, is there a section where we can add in reference implementation of the architecture of what the best practices would look like in software supply chain security. We h…
-
As per discussion https://github.com/open-quantum-safe/boringssl/pull/115#issuecomment-2089779310
- [x] Create CI image(s) with Ubuntu 22 & 24
- [ ] Deploy in CI testing
(- [ ] Create reminder…
-
Originally raised as https://github.com/pypi/warehouse/issues/12244 but they asked me to open it here instead. See that issue for the background.
**What's the problem this feature will solve?**
Ma…
-
SSH inside container can connect to GitHub even if I disable `forwardWSLServices` and `gitCredentialHelperConfigLocation`.
There are no keys in `~/.ssh` (inside container) and no `helper` in `git c…
-
Open Source is everywhere. It is in many proprietary codebases and community projects. For organizations and individuals, the question today is not whether you are or are not using open-source code, b…
-
David Britch pointed out that the topic on security best practices related to managing packages could be better surfaced. I agree. Perhaps linking directly to the actionable steps starting with this…
-
This issue tracks the PO SSDF items and will also contain more detail for them:
Work that addresses these items can reference this epic issue.
- PO.1.1: Identify and document all security requir…
-
This is a placeholder for initial discussion and work. This came out of 8/11/2021's SLSA community meeting. Currently it is not completely clear what is or is out of scope for SLSA.
Background: The…
-
### Feature Request
Currently it is not possible to verify the cryptographic authenticity after downloading the Trust Wallet software because the releases are not cryptographically signed.
This …
-
Checkout https://www.csoonline.com/article/3662782/sigstore-explained-how-it-helps-secure-the-software-supply-chain.html to know what Sigstore is and why it's important to use it.
For Maven, Sonaty…