Signing Research by Ry Walker

Category analysis of 10 developer trust and supply chain security tools. Covers Vouch (contributor trust), git-ai (AI code provenance), Sigstore (artifact signing), SLSA (build provenance), in-toto (attestation), zizmor (CI auditing), Socket.dev (proactive detection), OpenSSF Scorecard (project scoring), and GUAC (knowledge graph).