DevSecOps

On 19 October, the files in OVHcloud CLI releases were replaced with a credential stealer using a developer’s stolen credentials. I checked the latest release of 242 popular Go and Rust CLI projects: 179 could be swapped the same way, with nothing independent for a downloader to check. How I checked, why a checksum file doesn’t count, and three things maintainers can do.

This article introduces the installation, usage, and verification methods of the GaraSign code signing tool, helping developers achieve secure code signing.

This article introduces the concept and importance of code signing, along with a comparison of two common code signing tools, emphasizing its role in software supply chain security.