# Applying Zero Trust Principles to Open Source Software Supply Chain Security

DevFeed: [Applying Zero Trust Principles to Open Source Software Supply Chain Security](<https://devfeed.tech/articles/this-shit-is-hard-applying-zero-trust-to-open-source-software-13299.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/unchained-this-shit-is-hard-applying-zero-trust-to-open-source-software>)

Published: 2025-09-29T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Zero Trust](<https://devfeed.tech/topics/zero-trust.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Git](<https://devfeed.tech/topics/git.md>)

Tags: [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-security](<https://devfeed.tech/tags/chainguard-security.md>), [git](<https://devfeed.tech/tags/git.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-software](<https://devfeed.tech/tags/open-source-software.md>), [security](<https://devfeed.tech/tags/security.md>), [security-best-practices](<https://devfeed.tech/tags/security-best-practices.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [this-shit-is-hard](<https://devfeed.tech/tags/this-shit-is-hard.md>), [zero-trust](<https://devfeed.tech/tags/zero-trust.md>)

## AI overview

This article explains how Chainguard applies Zero Trust principles to open source software supply chain security. It discusses weaknesses in Git identity and long-lived credentials, including risks from impersonation, credential theft, and compromised package publishing.

## Source excerpt

Chainguard implements Zero Trust principles into everything we do to protect critical infrastructure in the age of open source. See how we do it.