At the inaugural CloudNativeSecurityCon in Seattle, former Chainguard intern Marina Moore (PhD candidate at NYU) and Chainguard research scientist Zack Newman took to the stage to present their talk:
"Not All That’s Signed Is Secure: Verify the Right Way with TUF and Sigstore” on how the Sigstore and The Update Framework (TUF) open source projects can be used to create verification policies to secure software supply chains of all shapes and sizes.
Key Takeaways
To learn more, please watch the talk, check out the slide deck, and get involved with the Sigstore and TUF projects. Not ready to build your own verification policies from scratch? Chainguard Enforce has built-in support for verification policies that support TUF and Sigstore, and any other policies for securing your software supply chain.
.png)
