-
We already have message types defined that describe the inputs to the verification process (`Bundle`, `TrustedRoot`, `ArtifactVerificationOptions`) so it seems reasonable to also define a standardized…
-
Add https://issuer.hello.coop as an OIDC Identity Provider for sigstore
For details on Hellō see https://hello.coop/ & https://hello.dev/
-
### First check
- [X] I am a contributor to the Prefect codebase
### Description
As supply chain compromises increase in both frequency and severity (notable instances include the [SolarWinds compr…
-
This is needed in order to support [Certificate Transparency](http://www.certificate-transparency.org/how-ct-works).
nginx already has a module for this: https://github.com/grahamedgecombe/nginx-ct
[…
-
## CVE-2020-14039 - Medium Severity Vulnerability
Vulnerable Libraries - github.com/google/certificate-transparency-go-v1.0.10, github.com/cloudflare/cfssl-1.3.2
github.com/google/certificate-trans…
-
Hey,
The certificate for https://invalid-expected-sct.badssl.com/ is expired on Sunday, November 18, 2018 at 12:59:59 AM and prevents to use this domain for its actual purpose.
Is it possible to…
-
Hello,
I saw there was a fix somewhere for this but when i tried it, I still had issues. Maybe someone can walm me through it?
c:\>go get -u github.com/cloudflare/cfssl/cmd/cfssl/ github.com/cl…
-
According to the docs , in order to place the pcapdroid cert in system store , [MagiskTrustuserCert](https://github.com/NVISOsecurity/MagiskTrustUserCerts) pulgin is adviced but instead [movecert](ht…
-
## Expected Behavior
Gradle should be able to sign and verify artifact signatures.
Of course, it would take time to migrate off PGP for Maven Central, however, having off the shelf sigstore suppor…
-
The working title "Source Code Transparency" may be confusing since what we want to hash & publish is not necessarily the original source code but rather the "compiled" web bundle that's distributed. …
twiss updated
9 months ago