News for hackers. Stuff that matters.
Re:NPM Provenance Public Beta by jacques_chester on Thursday April 20, 2023 @09:08AM (#35639357)
SCITT is still nascent. Sigstore is operating and in use by multiple ecosystems. On the principle of "rough consensus and running code", SCITT is not the leader.

> and logs it in Google's provided append only log

This is false. The entire sigstore effort is under the OpenSSF and the production systems are operated by volunteers from multiple companies.

There are no comments on this comment yet.