2022-05-09: debian:bullseye-20220509 Released

Debian publishes debian:bullseye-20220316 container image that DOES NOT include a fix for CVE-2022-1292.

In my previous post, Implementing Containers’ Secure Supply Chain with Sigstore Part 1 – Signing with Existing Keys, I went over the Cosign experience of signing images with existing keys. As I concluded there, the signing was easy to achieve, with just a few hiccups here and there. It does seem that Cosign does a […]

November 2, 2022November 2, 2022toddysm

Configuring a hierarchy of IoT Edge Devices at Home Part 3 – Configuring Business Planning and Logistics (IT)

In the last two posts Configuring a hierarchy of IoT Edge Devices at Home Part 1 – Configuring the IT Proxy and Configuring a hierarchy of IoT Edge Devices at Home Part 2 – Configuring the Enterprise Network (IT) we have set up the proxy and the top layer of the hierarchical IoT Edge network. This post […]

May 11, 2021May 10, 2021toddysm

Signatures, Key Management, and Trust in Software Supply Chains – Part 1: Identities, Signatures and Attestation

For the past few months, I’ve been working on a project for a secure software supply chain, and one topic that seems to always start passionate discussions is the software signatures. The President’s Executive Order on Improving the Nation’s Cybersecurity (EO) is a pivotal point for the industry. One of the requirements is for vendors […]

January 9, 2022January 9, 2022toddysm

How Can I Successfully Hack My Home Network?

This morning I was looking at our company’s e-mail gateway and cleaning some of the quarantined messages when I got reminded that while my company’s digital infrastructure may be well protected with firewalls and e-mail gateways, my home network can be wide open and vulnerable to attacks. Like everyone else, I try not to spend […]

February 18, 2019February 21, 2021toddysm

Implementing Containers’ Secure Supply Chain with Sigstore Part 3 – Ephemeral Keys and Artifact Promotion

In the last post of the series about Sigstore, I will look at the most exciting part of the implementation – ephemeral keys, or what the Sigstore team calls keyless signing. The post will go over the second and third scenarios I outlined in Implementing Containers’ Secure Supply Chain with Sigstore Part 1 – Signing […]

November 17, 2022November 17, 2022toddysm

2022-05-09: debian:bullseye-20220509 Released

2022-05-03: OpenSSL CVE-2022-1292 Fixed

2022-05-27: debian:bullseye-20220527 Released