3 ms·

My biggest takeaway from this article is the Supply chain Levels for Software Artifacts (SLSA) security framework: https://github.com/slsa-framework/slsa-verifi

My biggest takeaway from this article is the Supply chain Levels for Software Artifacts (SLSA) security framework: https://github.com/slsa-framework/slsa-verifier https://github.com/slsa-framework/slsa-verifier

Terretta 3y ago
> biggest takeaway from this article is the Supply chain Levels for Software Artifacts (SLSA) security framework See also GUAC from Kusari, Google, Citi, and others: “GUAC (Graph for Understanding Artifact Composition) aims to fill in the gaps by ingesting software metadata, like SBOMs, and mapping out relationships between software. When you know how one piece of software affects another, you’ll be able to fully understand your software security position and act as needed.” https://guac.sh https://guac.sh https://www.kusari.dev https://www.kusari.dev