https://shenxianpeng.dev/en/tags/slsa/Recent content in SLSA on Xianpeng ShenHugo -- gohugo.ioenxianpeng.shen@gmail.com (Xianpeng Shen)xianpeng.shen@gmail.com (Xianpeng Shen)Copyright © 2017–2026 Xianpeng Shen. All rights reserved.Mon, 10 Jun 2024 00:00:00 +0000https://shenxianpeng.dev/en/posts/2024/garasign/Mon, 10 Jun 2024 00:00:00 +0000xianpeng.shen@gmail.com (Xianpeng Shen)https://shenxianpeng.dev/en/posts/2024/garasign/This article introduces the installation, usage, and verification methods of the GaraSign code signing tool, helping developers achieve secure code signing.https://shenxianpeng.dev/en/posts/2024/code-signing/Mon, 29 Apr 2024 00:00:00 +0000xianpeng.shen@gmail.com (Xianpeng Shen)https://shenxianpeng.dev/en/posts/2024/code-signing/This article introduces the concept and importance of code signing, along with a comparison of two common code signing tools, emphasizing its role in software supply chain security.https://shenxianpeng.dev/en/posts/2023/supply-chain-security/Sat, 02 Dec 2023 00:00:00 +0000xianpeng.shen@gmail.com (Xianpeng Shen)https://shenxianpeng.dev/en/posts/2023/supply-chain-security/This article introduces how to implement software supply chain security using SLSA and Witness for both GitHub and non-GitHub projects, enhancing the security of software development and deployment processes.https://shenxianpeng.dev/en/posts/2023/witness-and-slsa/Thu, 30 Nov 2023 00:00:00 +0000xianpeng.shen@gmail.com (Xianpeng Shen)https://shenxianpeng.dev/en/posts/2023/witness-and-slsa/This article introduces the concept and working mechanism of Witness, and how to use Witness to generate and verify the provenance of software artifacts, emphasizing its importance in improving software supply chain security.https://shenxianpeng.dev/en/posts/2023/sbom/Sat, 10 Jun 2023 00:00:00 +0000xianpeng.shen@gmail.com (Xianpeng Shen)https://shenxianpeng.dev/en/posts/2023/sbom/This article introduces the definition of SBOM, its relationship and differences with SLSA and Black Duck, best practices, and available generation tools, helping readers better understand and apply SBOM.https://shenxianpeng.dev/en/posts/2023/slsa/Thu, 23 Mar 2023 00:00:00 +0000xianpeng.shen@gmail.com (Xianpeng Shen)https://shenxianpeng.dev/en/posts/2023/slsa/This article introduces the concept, purpose, and levels of the SLSA framework, and how to apply SLSA in the software supply chain to improve security. It helps readers understand the importance of SLSA in software development and deployment.