In this post, we’ll continue the exploration of Gitsign by extracting some of the attestation data from a signed commit and using it to check how the code was built. This will help you understand how you can use the attestation data in your workflows.

Worried about securing your source code supply chain for GitOps and other processes? Learn how to implement automated signing in CI/CD pipelines, verify commit authenticity using transparency logs, and leverage GitHub OIDC tokens with Gitsign for keyless commit signing.

Every journey begins with a first step. Learn how eliminating data leaks and implementing privacy controls led my wife and I to build a smarter home.

So many times, teams use “it should work” as the reason why their software or processes don’t require testing. For example, the code is so simple, it should work. Or, the code was tested on Linux, so it should work on Windows. In reality, this can be dangerous at best … and fatal at worst.

The world of software development is changing rapidly. With Google’s latest announcement, part of how we deploy systems is getting ready to change for the better for nearly half of all companies. Are your teams ready for the challenge?

Ever needed to automate creating an Azure Entra ID (Azure Active Directory) application and federating it with GitHub? With just a little PowerShell, you can!

Security is at the heart of what we do in DevOps (if we’re doing it right). This includes protecting our CI/CD processes from malicious users and behaviors. One of the more interesting exploit vectors with build and release pipelines is a classic: the injection attack. This post reviews the basics of injection exploits and shows you how to easily avoid them.

With the rise of OIDC, we no longer need to rely on secret keys or passwords to connect two services together. Instead, we can configure a trust relationship between the services and use that to securely request tokens for accessing resources. Adopting this approach can simplify things, but it can be scary for security teams and developers; they want to understand what makes this process work. In this post, walk through what’s happening under the covers.

What you don’t know can hurt you, especially when it comes to code. Dependency chains can tend to have more security considerations than most people realize. In fact, most dependencies have far more abilities than most developers realize …

For certificates to work, we need a system of trust. We need to know that each certificate is valid and was properly issued. This is the role of the certificate authorities (CAs). In the second part of this series, we’ll explore the role of CAs and how certificates are validated. We’ll also look at creating a private CA using a self-signed certificate.