project
Open-source Sigstore tool for signing, verifying, and storing cryptographic signatures on container images and software artifacts.
k8s-secure-supply-chain, a kind-based reference build, uses five Kyverno checks to refuse at admission any image that CI did not sign and attest. Its author argues that CI scans and signatures stay advisory until the cluster enforces them.
Reality
Akamai says the May 11-12 wave poisoned a CI cache and minted publish credentials from inside a trusted build, so the attestation it produced was honest. Any gate that only checks for provenance would have passed it.
Reality
A dev.to writeup lays out per-account EKS clusters, digest-only promotion and OIDC everywhere. The metric-backed gate it calls critical is the thinnest part of the design.
Reality
field-cage blocks outbound connections from Linux runners in the kernel, keeps its logs on the box, and disclaims step correlation, tamper detection and organization-wide visibility.
Reality
Flux Mirror ships as a v2.9 CLI plugin that copies images, charts and desired-state artifacts from a config file. The Bitnami catalogue freeze is the argument for using it.
Reality
A developer's argument that .env access is an architectural bug in agent workflows, and a small Go CLI that brokers credentials at the process and transport boundary instead.
Reality