Topic

cosign

2 posts

SBOM Signing in CI: How to Sign and Attest With Cosign

One CI shape: build an image by digest, Syft SBOM, Cosign sign + SBOM attest, verify success, and prove wrong-key/unsigned failure — the operational follow-on to after-xz.

29 Sept 20269 min read

Supply Chain Security Checklist for Small Teams After xz

Turn the xz-utils backdoor lesson into action: tarball vs git diffs, SBOM, Sigstore Cosign, SLSA provenance, and a solo/small-team release gate you can run this week.

29 Sept 202610 min read