The question that reorganised our entire supply chain programme took about eleven seconds to ask. Not “do you sign your images.” Not “do you scan for vulnerabilities.” It was: for the container that was running in production on that date, show me the commit it came from, show me the build that produced it, andContinue reading “A Software Supply Chain That Survives a Regulator: SLSA, Sigstore and SBOMs in Practice”
