dlor 的提交内容

Supply chain security for Go, Part 2: Compromised dependencies

The Principle of Minimalism

Fully bootstrapping Java from source in Wolfi

Removing PGP from PyPI

Sigstore: Roots of Trust for Software Artifacts

He Untold Story of the Boldest Supply-Chain Hack Ever

Feeling VEXed by software supply chain security? Us, too

87% of Container Images in Prod Have Critical or High-Severity Vulnerabilities

Towards Easier, More Secure Signature Tech for the Java Ecosystem with Sigstore

GitHub says hackers cloned code-signing certificates in breached repository

Memory safety is the new black, fashionable and fit for any occasion

Understanding the relationship between FOSS and the “software supply chain”

Are SBOMs Good Enough for Government Work?