rekor

You lose some benefits around decentralized trust & temporal anchoring. But not all. DLT are established in software supply chains and are being adapted to AI supply chain (see below). It's not indicative of a "crypto" play. "Sigstore’s public signing ledgers form the foundation of trust for SLSA provenance" - https://storage.googleapis.com/gweb-research2023-media/pubto... https://docs.sigstore.dev/logging/overview/ https://github.com/sigstore/rekor

From the sigstore docs: https://docs.sigstore.dev/ : > sigstore empowers software developers to securely sign software artifacts such as release files, container images, binaries, bill of material manifests [SBOM] and more. Signing materials are then stored in a tamper-resistant public log. /? sigstore sbom: https://www.google.com/search?q=sigstore+sbom > It’s free to use for all developers and software providers, with sigstore’s code and operational tooling being 100% open source, and everything maintained and developed by the sigstore community. > How sigstore works: Using Fulcio, sigstore requests a certificate from our root Certificate Authority (CA). This checks you are who you say you are using OpenID Connect, which looks at your email address to prove you’re the author. Fulcio grants a time-stamped certificate, a way to say you’r

Dan's team and Google has worked with our team on implementation of the DSSE spec, see https://github.com/sigstore/rekor/pull/596. I really don't understand the rent seeking argument. It is made completely without basis. However, I'd love to see the IETF author contribute a COSE type to rekor and show how it is better than DSSE for attestations.

> GitHub acts as a trusted third party here, and you have to trust them not to lie about people's public keys, so it may not be appropriate for all use cases. But relying on a trusted third party with a professional security team like GitHub seems like a way better default than PGP's Web of Trust, which was nigh impossible to use. Hopefully that's a false dichotomy and the entire Free Software community doesn't end up reliant on Microsoft to host all our keys for us. The article goes on to mention key transparency, though, which does seem like the right solution. I note that rekor (the transparency log implementation used by sigstore) already supports signing with SSH keys[0], so this TechRepublic article about it[1] from March (which lists only "GPG, x509 and Minisign") is already out of date. [0] https://github.com/sigstore/rekor/blob/

I also should have linked to Google's page about tamper-evident logs[0] (which they specifically mention can be used by package managers), and Rekor[1] (which describes itself as a "Secure Supply Chain - Transparency Log"). [0] https://transparency.dev/ [1] https://github.com/sigstore/rekor

Rekor is just that. It's a merkle tree implementation (with extras such as timestamping) https://github.com/sigstore/rekor

Maybe take a look at rekor, part of the sigstore project, it's built specifically for software supply chain transparency (disclaimer I am one of the community). Being a transparency log, you get much better guarantees around inclusion proof (it uses a merkle tree): https://github.com/sigstore/rekor

Maybe take a look at rekor, part of the sigstore project, it's built specifically for software supply chain transparency (disclaimer I am one of the community): https://github.com/sigstore/rekor

The rekor project under sigstore is interesting in this regard: https://github.com/sigstore/rekor Its listed as a signature transparency log, but they support some sort of custom manifest system, so you can set your own schema in your prefered format (xml, json, yaml) - the only thing is they require the manifest / material file is signed (I guess as it then brings a level of non-repudation). I am hoping someone works on an SBOM type. I heard some of the in-toto folks are working on the project as well. This is a good step towards a SBOM recorded supply chain.