Tag: #in-toto

Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 2 posts

Software Supply Chain Security 2026 — Sigstore, SLSA, SBOM (CycloneDX/SPDX), Chainguard Images, Socket.dev, JFrog Xray, Snyk Open Source, GUAC, in-toto, GitHub Actions OIDC Deep Dive
As of May 2026, software supply chain security is no longer optional. The 2020 SolarWinds Orion breach, the 2021 Log4Shell crisis, the March 2024 XZ Utils backdoor (the Jia Tan affair), and the steady drumbeat of npm and
2026-05-16 · 31 min read #software-supply-chain #sigstore #slsa #sbom #cyclonedx
Container Registries in 2026 — Docker Hub / GHCR / ECR / Harbor / Quay / Zot / Cosign + Sigstore Deep Dive
In 2026, container registries are no longer just a docker push away. Following Docker Hub pricing changes, GHCR has effectively become the OSS standard. Harbor has matured into the self-hosting default as a CNCF graduate
2026-05-16 · 27 min read #container #registry #docker-hub #ghcr #ecr

Software Supply Chain Security 2026 — Sigstore, SLSA, SBOM (CycloneDX/SPDX), Chainguard Images, Socket.dev, JFrog Xray, Snyk Open Source, GUAC, in-toto, GitHub Actions OIDC Deep Dive