Signing Research by Ry Walker

Category analysis of 6 developer trust and supply chain security tools. Covers Vouch (contributor trust), Sigstore (artifact signing), OpenSSF Scorecard (project scoring), SLSA (build provenance), Socket.dev (proactive detection), and in-toto (attestation).