tag

#signing

2 posts

SRE & DevOpsDeep Dive October 11, 2026 7 min read

in-toto Statements: Bind Verified Claims to the Artifact You Actually Deploy

Build artifact policy around in-toto Statement v1: digest-bound subjects, authenticated payloads, predicate typing, authorized signers, and negative tests.

#supply-chain#security#signing

SRE & DevOpsDeep Dive October 11, 2026 7 min read

TUF Update Trust: Roles, Root Rotation, Freshness, and Recovery Boundaries

Design a TUF update client with authenticated bootstrap roots, threshold key rotation, snapshot bindings, expiry and rollback checks, and bounded recovery.

#supply-chain#security#signing