cid 1620917497fb2e0ebfcadee548a912f9fca98fbffcb17173c09648c9745bf422 · original · open access · via openalex
Title: Sigstore Authors: Zachary Newman; John Speed Meyers; Santiago Torres-Arias Venue: ACM SIGSAC Conference on Computer and Communications Security (CCS) Year: 2022 Canonical: doi:10.1145/3548606.3560596 URL: https://doi.org/10.1145/3548606.3560596 Collector: openalex OA: true ABSTRACT Software supply chain compromises are on the rise. From the effects of XCodeGhost to SolarWinds, hackers have identified that targeting weak points in the supply chain allows them to compromise high-value targets such as U.S. government agencies and corporate targets such as Google and Microsoft. Software signing, a promising mitigation for many of these attacks, has seen limited adoption in open-source and enterprise ecosystems.