Stay updated with breaking news from Open Source Security Team. Get real-time updates on events, politics, business, and more. Visit us for reliable news and exclusive interviews.
Google expands its bug bounty programme to encompass generative AI and takes steps to grow its commitment to supply chain security as it relates to the emerging technology
Sigstore is an open source project launched by Linux Foundation with the goal of providing free and stable services for all developers to easily sign, verify and protect their software projects. While code signing is a valuable tool to prevent hackers from co-opting patching systems and delivering malware, it is difficult to implement in open source projects given the complexity of key management.
Here's a comprehensive look at some of the lesser-known, but no less serious, types of software supply chain attacks.
SBOMs should be connected with vulnerability databases to fulfill their promise of reducing risk, Google security team says.
The GitHub Advisory Database is now open to community contributions to help further the security of open source software.