Re:Software supply chain security
by trishankdatadog on Friday September 04, 2020 @11:19AM
(#24375692)
Philip is right: they are complementary:
https://ssl.engineering.nyu.edu/blog/2020-02-03-transparent-...
Asset Transparency doesn't require the publisher to be involved at all and can work on any URL on the internet that is publicly accessible. It also complementary to signing schemes.
Here is the Asset Transparency CLI fetching and verifying the contents of a notary release for example:
Or if you are curious hit the service’s lookup endpoint directly: