A New Tool Wants to Save Open Source from Supply Chain Hacks

Sigstore will make code signing free and easy for software developers, providing an important first line of defense.

source https://www.wired.com/story/sigstore-open-source-supply-chain-code-signing