PGP vs. sigstore: A recap of the match at Maven Central
7 minute read time
We put code-signing tools PGP and sigstore in a head-to-head match with Maven Central users to find a winner. The results may surprise you.
Read More...
EU Cyber Resilience Act: Good for software supply chain security, bad for open source?
10 minute read time
The Cyber Resilience Act is the European Union's proposed regulation to combat threats affecting any digital entity. What does that mean for open source?
Read More...
Perception versus reality: A data-driven look at open source risk management
2 minute read time
Get insights, background, and data and key takeaways from the 8th Annual State of the Software Supply Chain report. Hosted by Dr. Stephen Magill.
Read More...
Open source best practices for higher quality code to fundamentally strengthen your project
8 minute read time
A look at some basic practices for higher quality code to help fundamentally strengthen your project.
Read More...
An open source maintainer's best practice: How to use SBOMs to root out project vulnerabilities
6 minute read time
The second entry in Sonatype's series for Security Slam explores how your project can benefit from the use of a software bill of materials (SBOM).
Read More...
Stop the low-quality contribution plague
5 minute read time
You’ve heard the phrase. Today we talk about how to actually low quality when contributing to open source projects.
Read More...
Open source best practices: Key documents to help welcome new contributors to your project
5 minute read time
This series of blog posts on best practices for open source maintainers was created in partnership with CNCF for Sonatype's Security Slam event.
Read More...
How to become a new open source contributor
4 minute read time
There is no perfect recipe for getting involved with an OSS community, but there are some things you can do to help you get past the barriers to entry.
Read More...
Rule over your dependencies and scan at your own open source risk
5 minute read time
A good way to make sure that your organization's vulnerabilities don't go unnoticed is conducting regular scans of open source used in your environments.
Read More...