Meder Kydyraliev

@lumjjb @lorenc_dan @decodebytes @sabre1041 @J0hnKjell @solomonstre @projectsigstore +1 to the awareness of the cloud native bias, particularly given that most of the container images contain OSS that comes from linux distros and other package managers.

@lumjjb @lorenc_dan @decodebytes @sabre1041 @J0hnKjell @solomonstre @projectsigstore There's a technical component to the supply chain problem, but at its core it's about changing habits and practices of a large number of developers. Would new package manager just add an additional problem of adoption into the equation?

I’m not sure exactly how but, .@projectsigstore is the answer

👇👇👇 Check out how Google Open Source Security Team (@GoogleOSS) is supporting @ReproBuilds in this next instalment in our interview series... this time between @meder and @lolamby. 🔷 👇👇👇 reproducible-builds.org/news/2022/04/2…

GitHub Workflows + OIDC + Sigstore = significantly more secure supply chain using readily available tools!

@_tallison @ApacheTika You can make a case for your project’s criticality in the submission.

Very excited to announce Secure Open Source! Program that rewards OSS developers for a broad range of security improvements. See sos.dev for details on how to participate. security.googleblog.com/2021/10/introd…