# slsa Published articles for slsa. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Proven, not promised: Chainguard Containers achieves SLSA Build Level 3 DevFeed: [Proven, not promised: Chainguard Containers achieves SLSA Build Level 3]() Original publisher: [Read original article]() Published: 2026-08-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [supply-chain-security](), [software bill of materials](), [Security]() Tags: [chainguard](), [chainguard-containers](), [provenance](), [sbom](), [security](), [signing](), [slsa](), [software-supply-chain-security](), [supply-chain]() ### AI overview Chainguard says Coalfire independently assessed the Chainguard Containers build and release system as meeting SLSA Build Level 3 requirements. The article describes hardened, isolated builds, separately managed signing, provenance generation, and signed SBOMs for releases. ### Source excerpt Coalfire independently assessed Chainguard Containers at SLSA Build Level 3, validating hardened builds, provenance, and supply chain integrity. ## ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough DevFeed: [ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough]() Original publisher: [Read original article]() Author: Harness Team Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [ChainDrop](), [npm](), [supply-chain-security](), [Malware](), [npm packages](), [GitHub Actions](), [GitHub]() Tags: [chaindrop](), [ci](), [ci-cd](), [github](), [github-actions](), [integrity](), [least-privilege](), [malware](), [npm](), [npm-worm](), [openid-connect](), [provenance](), [security](), [slsa](), [software-supply-chain-security](), [worm]() ### AI overview The ChainDrop npm worm compromised hundreds of packages while retaining valid SLSA provenance, demonstrating that build attestations do not guarantee source integrity. The article explains the worm's propagation, credential theft, persistence mechanisms, and recommended defenses, including source governance, dependency controls, least-privilege identities, policy gates, and runtime evidence. ### Source excerpt ChainDrop poisoned hundreds of npm packages while retaining valid provenance. Learn why signed builds need source governance, policy gates, and runtime evidence | Blog ## Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-18T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [Security](), [Open Source]() Tags: [2026](), [chainguard](), [chainguard-gartner](), [chainguard-gartner-magic-quadrant](), [cyber-resilience-act](), [fedramp](), [gartner](), [gartner-mq-software-supply-chain](), [nis2](), [provenance](), [sboms](), [secure-by-default](), [security](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [software-supply-chain-security-gartner]() ### AI overview Chainguard announces that it has been recognized as a Leader in the 2026 Gartner Magic Quadrant for Software Supply Chain Security. The article highlights Chainguard's secure-by-default approach, hardened open source artifacts, cryptographic signatures, signed SBOMs, and SLSA-aligned provenance, along with support for regulatory requirements. ### Source excerpt Chainguard named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security, recognized for vision and secure-by-default innovation. ## Anchore Enterprise now validates Chainguard Libraries: prevent 98% of Python malware and eliminate high-severity CVE toil DevFeed: [Anchore Enterprise now validates Chainguard Libraries: prevent 98% of Python malware and eliminate high-severity CVE toil]() Original publisher: [Read original article]() Published: 2025-12-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [Python](), [supply-chain-security](), [Malware](), [Open Source]() Tags: [anchore](), [anchore-chainguard](), [anchore-chainguard-partnership](), [anchore-enterprise](), [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-python](), [dependencies](), [malware](), [provenance](), [python](), [sboms](), [slsa](), [supply-chain](), [supply-chain-security]() ### AI overview Anchore Enterprise now supports scanning and validating Chainguard Libraries for Python. The integration combines Anchore's supply-chain security enforcement with Python libraries built from source in a tamper-proof, SLSA L2-certified environment with provenance and signed SBOMs, aiming to prevent malware introduced during build or distribution and reduce high-severity CVE remediation effort. ### Source excerpt Customers can now leverage Anchore Enterprise's scanning capabilities for Chainguard Libraries for Python. ## Applying Zero Trust Principles to Open Source Software Supply Chain Security DevFeed: [Applying Zero Trust Principles to Open Source Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2025-09-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Zero Trust](), [Open Source](), [open-source-security](), [supply-chain-security](), [Security](), [Git]() Tags: [chainguard-containers](), [chainguard-libraries](), [chainguard-security](), [git](), [open-source](), [open-source-software](), [security](), [security-best-practices](), [slsa](), [supply-chain-security](), [this-shit-is-hard](), [zero-trust]() ### AI overview This article explains how Chainguard applies Zero Trust principles to open source software supply chain security. It discusses weaknesses in Git identity and long-lived credentials, including risks from impersonation, credential theft, and compromised package publishing. ### Source excerpt Chainguard implements Zero Trust principles into everything we do to protect critical infrastructure in the age of open source. See how we do it. ## Announcing Chainguard Libraries for JavaScript: Malware-Resistant Dependencies Built Securely from Source DevFeed: [Announcing Chainguard Libraries for JavaScript: Malware-Resistant Dependencies Built Securely from Source]() Original publisher: [Read original article]() Published: 2025-09-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [JavaScript](), [Malware](), [npm packages](), [npm]() Tags: [attacks](), [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-javascript](), [javacript](), [javascript](), [language-library-security](), [malware](), [npm](), [npm-packages](), [package-compromise](), [provenance](), [shai-hulud](), [slsa]() ### AI overview Chainguard announces Chainguard Libraries for JavaScript, a source of trusted language-dependency builds intended to protect developers and organizations from compromised packages, malicious updates, and registry-based attacks. The libraries are built from source on hardened SLSA L2 infrastructure, include provenance, and are designed to fit existing developer workflows. ### Source excerpt Chainguard Libraries for JavaScript is designed to protect developers and organizations from compromised packages, malicious updates, and registry-based attacks. ## Malware-Resistant Python without the Guesswork DevFeed: [Malware-Resistant Python without the Guesswork]() Original publisher: [Read original article]() Published: 2025-08-01T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries for python](), [chainguard libraries](), [Security](), [chainguard](), [Open Source](), [Malware]() Tags: [chainguard-libraries](), [chainguard-libraries-for-python](), [malicious-packages](), [malware](), [num2words](), [provenance](), [pypi](), [python](), [reproducibility](), [sbom](), [secure-packages](), [security](), [signing](), [slsa](), [supply-chain]() ### AI overview The article presents Chainguard Libraries for Python as a way to reduce malware and software supply chain risks in Python package consumption. It describes rebuilding packages from upstream source in an isolated, reproducible SLSA Level 2 environment, and publishing signed SBOMs and provenance information. ### Source excerpt The recent compromise of the num2words package never made it into Chainguard Libraries for Python. Get the breakdown from the team on our packages you can trust. ## This Shit is Hard: SLSA L3 and Beyond DevFeed: [This Shit is Hard: SLSA L3 and Beyond]() Original publisher: [Read original article]() Published: 2025-07-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard](), [Containers](), [Security]() Tags: [chainguard](), [chainguard-containers](), [compliance](), [containers](), [provenance](), [security](), [security-engineering](), [signing](), [slsa](), [software-supply-chain](), [software-supply-chain-security]() ### AI overview Chainguard explains how it uses SLSA to strengthen software supply chain security, support customer compliance, and build trust in hardened container images. The article focuses on SLSA Build Level 3, especially isolated build execution and tamper-resistant provenance attestations with signing secrets separated from build and test processes. ### Source excerpt Chainguard goes through all the necessary steps to make things SLSA 3 compliant. Get the details on how we do it. ## Google introduces OSS Rebuild for reproducible open-source package artifacts DevFeed: [Google introduces OSS Rebuild for reproducible open-source package artifacts]() Original publisher: [Read original article]() Author: Kimberly Samra (noreply@blogger.com) Published: 2025-07-21T21:34:00Z Content type: release Language: en Sources: [Google Online Security]() Topics: [open-source-security](), [Open Source](), [supply chain attacks](), [npm](), [PyPI](), [Rust]() Tags: [announce](), [none](), [npm](), [open-source](), [open-source-security](), [pypi](), [rust](), [slsa](), [supply-chain-attacks]() ### AI overview Google announced OSS Rebuild, a project that reproduces upstream package artifacts to provide build definitions, SLSA provenance, and verification tools for PyPI, npm, and Crates.io packages. ### Source excerpt Posted by Matthew Suozzo, Google Open Source Security Team (GOSST) Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts. As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers. The project comprises: Automation to derive declarative build definitions for existing PyPI (Python), npm (JS/TS), and Crates.io (Rust) packages. SLSA Provenance for thousands of packages across our supported ecosystems, meeting SLSA Build Level 3 requirements with no publisher intervention. Build observability and verification tools that security teams can integrate into their existing vulnerability management workflows. Infrastructure definitions to allow organizations to easily run their own instances of OSS Rebuild to rebuild, generate, sign, and distribute provenance. Challenges Open source software has become the foundation of our digital world. From critical infrastructure to everyday applications, OSS components now account for 77% of modern applications. With an estimated value exceeding $12 trillion, open source software has never been more integral to the global economy. Yet this very ubiquity makes open source an attractive target: Recent high-profile supply chain attacks have demonstrated sophisticated methods for compromising widely-used packages. Each incident erodes trust in open ecosystems, creating hesitation among both contributors and consumers. The security community has responded with initiatives like OpenSSF Scorecard, pypi's Trusted Publishers, and npm's native SLSA support. However, there is no panacea: Each effort targets a certain aspect of the problem, often making tradeoffs like shifting work onto publishers and maintainers. Our Aim Our aim with OSS Rebuild is to empower the security community to deeply understand and control their supply chains by makin ## Custom Assembly and Private APK Repositories are Now Generally Available DevFeed: [Custom Assembly and Private APK Repositories are Now Generally Available]() Original publisher: [Read original article]() Published: 2025-07-15T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [APK](), [container images](), [Security]() Tags: [announce](), [apk-repositories](), [chainguard-containers](), [container-images](), [custom-assembly](), [cve-remediation](), [new-features](), [secure-image](), [slsa]() ### AI overview Chainguard announces the general availability of Custom Assembly and Private APK Repositories for Chainguard Containers. The features let customers customize container images, access Chainguard packages through customer-specific endpoints, and use Chainguard Factory for automated builds and ongoing maintenance. ### Source excerpt Custom Assembly and Private APK Repositories, two new features for Chainguard Containers, are now generally available. ## No CVEs, No Surprises: Chainguard and the UK Software Security Code of Practice DevFeed: [No CVEs, No Surprises: Chainguard and the UK Software Security Code of Practice]() Original publisher: [Read original article]() Published: 2025-06-09T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [chainguard](), [chainguard containers](), [supply-chain-security](), [sdlc](), [Development](), [Cloud Native Ecosystem](), [Resilience](), [sigstore](), [Deployment]() Tags: [chainguard](), [chainguard-containers](), [compliance](), [cyber-resilience-act](), [emea](), [resilience](), [security](), [sigstore](), [slsa](), [software-development](), [software-supply-chain](), [sscop](), [ssdf](), [testing](), [uk](), [united-kingdom](), [zero-cves]() ### AI overview The article explains the United Kingdom's Software Security Code of Practice and maps its 14 principles across secure development, build integrity, deployment, and customer communication. It presents Chainguard Containers, provenance attestations, and signed SBOMs as ways Chainguard supports secure-by-default software and compliance efforts. ### Source excerpt Chainguard Containers support compliance with the United Kingdom's Software Security Code of Practice. Check out what the framework entails and how we help. ## Chainguard's Catalog of 1,300+ Container Images: Secure Foundation for Every Engineering Team DevFeed: [Chainguard's Catalog of 1,300+ Container Images: Secure Foundation for Every Engineering Team]() Original publisher: [Read original article]() Published: 2025-05-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [chainguard](), [Containers](), [chainguard os](), [container-security](), [Open Source](), [sigstore]() Tags: [chainguard](), [chainguard-catalog](), [chainguard-containers](), [chainguard-factory](), [chainguard-images](), [chainguard-os](), [container](), [container-images](), [cve-remediation](), [dependencies](), [open-source](), [provenance](), [safe-source-for-open-source](), [sigstore](), [slsa]() ### AI overview Chainguard describes its catalog of more than 1,300 minimal, zero-CVE container images, built from source on Chainguard OS and maintained through the Chainguard Factory. The article highlights daily rebuilds, automated dependency and CVE handling, and default SBOMs, SLSA provenance, and Sigstore signatures. ### Source excerpt Chainguard Containers is a catalog of over 1,300 container images powered by Chainguard OS and the Chainguard Factory. Discover the safe source for open source. ## Evaluating Container Security with Container Hardening Priorities: Some CHPs for Your SLSA DevFeed: [Evaluating Container Security with Container Hardening Priorities: Some CHPs for Your SLSA]() Original publisher: [Read original article]() Published: 2025-04-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container-security](), [container images](), [supply-chain-security](), [Security]() Tags: [best-practices](), [chainguard](), [chainguard-containers](), [chainguard-images](), [chps](), [configuration](), [container-hardening-priorities](), [container-image](), [container-images](), [container-security](), [hardening](), [minimalism](), [provenance](), [security](), [security-best-practices](), [slsa](), [standard](), [supply-chain-security](), [vulnerabilities]() ### AI overview Chainguard introduces Container Hardening Priorities (CHPs), a framework for assessing container image security. CHPs complements SLSA and focuses initially on build-time characteristics including minimalism, provenance, configuration and metadata, and vulnerabilities. ### Source excerpt Chainguard has announced Container Hardening Priorities (CHPs), a new framework to assess the security of container images. Learn how it works. ## Announcing Chainguard Libraries: Guarded Java Language Dependencies Built from Source DevFeed: [Announcing Chainguard Libraries: Guarded Java Language Dependencies Built from Source]() Original publisher: [Read original article]() Published: 2025-03-25T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [supply-chain-security](), [Java]() Tags: [built-from-source](), [chainguard](), [chainguard-libraries](), [dependencies](), [java](), [packages](), [slsa](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview Chainguard announces the beta release of Chainguard Libraries, a catalog of guarded Java dependencies built from source in SLSA-certified infrastructure. The service aims to give enterprises a standardized, safer way to consume language libraries while preserving existing developer workflows. ### Source excerpt Chainguard Libraries is a catalog of guarded Java dependencies built securely from source in Chainguard's SLSA-certified infrastructure. ## Announcing Chainguard Custom Assembly: Image Customization Without Complexity DevFeed: [Announcing Chainguard Custom Assembly: Image Customization Without Complexity]() Original publisher: [Read original article]() Published: 2025-02-20T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [open-source-security](), [Containers](), [Security](), [Development]() Tags: [bash](), [chainguard](), [chainguard-custom-assembly](), [chainguard-images](), [complexity](), [container-images](), [curl](), [custom-assembly](), [customization](), [cve](), [cve-remediation](), [development](), [docker](), [image](), [integrity](), [maintenance](), [no-vulnerabilities](), [open-source](), [open-source-software](), [secure-by-design](), [security](), [security-best-practices](), [slsa](), [zero-cves]() ### AI overview Chainguard announces the beta release of Custom Assembly, a product for tailoring Chainguard Images with required packages while preserving hardened builds, security practices, and CVE remediation coverage. The article explains that the product addresses complex, maintenance-heavy customization workflows involving manual image changes, Docker builds, and proprietary pipelines. ### Source excerpt Custom Assembly is Chainguard's new image customization product that enables companies to consume zero-CVE open source software tailored to unique requirements. ## Chainguard Images Are Now Available for Government of Canada Organizations DevFeed: [Chainguard Images Are Now Available for Government of Canada Organizations]() Original publisher: [Read original article]() Published: 2025-01-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [chainguard](), [container images](), [Cybersecurity]() Tags: [canada](), [chainguard](), [chainguard-images](), [container-images](), [cybersecurity](), [government](), [government-of-canada](), [slsa](), [software-licensing-supply-arrangement]() ### AI overview Chainguard Images are now available for purchase by Government of Canada organizations through a Software Licensing Supply Arrangement with Carahsoft. The article explains how the arrangement supports procurement of Chainguard's zero-CVE Guarded Container Images and relates their security benefits to the Government of Canada's cybersecurity strategy. ### Source excerpt Chainguard Images are now available for purchase by Government of Canada organizations thanks to our Software Licensing Supply Arrangement with Carahsoft. ## Check out Chainguard at KubeCon NA in Salt Lake City on November 12-15! DevFeed: [Check out Chainguard at KubeCon NA in Salt Lake City on November 12-15!]() Original publisher: [Read original article]() Published: 2024-10-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard images](), [container images](), [supply-chain-security](), [sigstore](), [distroless](), [CI/CD](), [Cloud](), [Security](), [devrel]() Tags: [chainguard](), [chainguard-images](), [ci-cd](), [cloud](), [cloud-native-rejekts](), [conference](), [container](), [debug](), [developers](), [devrel](), [devsecops](), [distroless](), [event](), [kubecon](), [kubernetes](), [multi-arch](), [sboms](), [security](), [sigstore](), [sigstorecon](), [slsa](), [software-supply-chain-security]() ### AI overview Chainguard announces its participation in KubeCon North America 2024 in Salt Lake City, including product demonstrations of Chainguard Images and appearances at Cloud-Native Rejekts and SigstoreCon. ### Source excerpt Chainguard is going to be at KubeCon North America 2024 in Salt Lake City. See where we'll be and how you can meet us to learn more about Chainguard Images. ## Introducing Chainguard's Trust Center DevFeed: [Introducing Chainguard's Trust Center]() Original publisher: [Read original article]() Published: 2024-05-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Security](), [supply-chain-security](), [chainguard images](), [soc 2]() Tags: [audit](), [certifications](), [chainguard](), [compliance](), [iso-27001](), [nist](), [security](), [slsa](), [soc](), [soc2](), [software-security-audit](), [software-security-best-practices](), [software-supply-chain](), [software-supply-chain-security](), [trust-center]() ### AI overview Chainguard introduces its Trust Center, a platform that centralizes security, compliance, and privacy information for users and customers. The center provides access to independent penetration-testing assessments, a SOC 2 Type 2 audit report, hardening guidance, privacy information, data-subprocessor details, and information security policies. ### Source excerpt Learn how Chainguard prioritizes security with our new Trust Center. Find info on our policies, certifications, and how we protect your software supply chain. ## Strengthening your software supply chain security DevFeed: [Strengthening your software supply chain security]() Original publisher: [Read original article]() Published: 2024-01-08T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Security](), [Software](), [Vulnerabilities](), [chainguard images](), [container images](), [sigstore](), [snyk]() Tags: [chainguard](), [container-images](), [containers](), [cve](), [dependency](), [grype](), [image](), [reproducible-builds](), [sbom](), [security](), [sigstore](), [slsa](), [snyk](), [software](), [solarwinds](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-scanning](), [wolfi]() ### AI overview This article explains software supply chain risks from open-source and third-party components, using the SolarWinds attack as an example. It recommends verifying artifacts, signing container images, minimizing dependencies, updating software, scanning for vulnerabilities, using smaller base images, adopting reproducible builds, and increasing SLSA maturity. ### Source excerpt Secure your codebase with advanced supply chain security tactics: artifact authentication, minimal images and more from Chainguard. ## Elastic partners with Chainguard on Software Supply Chain security and SLSA assessment DevFeed: [Elastic partners with Chainguard on Software Supply Chain security and SLSA assessment]() Original publisher: [Read original article]() Published: 2023-07-26T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard](), [Security](), [open-source-security](), [sigstore](), [Open Source]() Tags: [chainguard](), [open-source](), [open-source-software](), [security](), [sigstore](), [slsa](), [slsa-assessement](), [slsa-levels](), [software-artifact-signing](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain](), [trust]() ### AI overview Elastic partnered with Chainguard to assess its software supply chain using the SLSA framework. The article describes supply-chain risks across source, build, dependencies, and packages, and highlights software artifact signing with Sigstore as a security measure. ### Source excerpt Elastic and Chainguard unite for enhanced software supply chain security and SLSA assessment. ## Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance DevFeed: [Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance]() Original publisher: [Read original article]() Published: 2023-06-30T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [CI/CD](), [supply-chain-security](), [DevSecOps](), [Cybersecurity](), [cisa]() Tags: [chainguard-images](), [ci-cd](), [cicd](), [cisa](), [continuous-verification](), [cybersecurity](), [devsecops](), [secure-software-development-frameworks](), [security](), [sigstore](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview This commentary explains NSA and DHS CISA guidance for securing CI/CD environments. It highlights risks to downstream environments and software consumers, including compromised developer credentials and application libraries, and recommends established software supply chain security frameworks such as SLSA and CNCF best practices. ### Source excerpt Fortify your CI/CD environments with insights from NSA and DHS CISA guidance, presented by Chainguard. ## An enhanced Chainguard Academy learning experience DevFeed: [An enhanced Chainguard Academy learning experience]() Original publisher: [Read original article]() Published: 2023-06-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Learning](), [supply-chain-security](), [Security](), [Documentation](), [chainguard images](), [Open Source]() Tags: [chainguard](), [chainguard-academy](), [chainguard-images](), [sboms](), [security](), [slsa](), [slsa-levels](), [software-education](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview Chainguard announces an enhanced Chainguard Academy with a redesigned user experience, improved navigation, topic pages, and expanded educational resources covering software security, software supply chain security, SLSA, SSDF, SBOMs, apko, and Wolfi. The article also highlights ongoing product documentation updates for Chainguard Images and Chainguard Enforce. ### Source excerpt Catch the latest updates from Chainguard Academy, including a new design and software security resources for SLSA, SSDF and more. ## OSS security: Chainguard May 2023 update DevFeed: [OSS security: Chainguard May 2023 update]() Original publisher: [Read original article]() Published: 2023-05-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [open-source-security](), [chainguard](), [supply-chain-security](), [Kubernetes]() Tags: [chainguard](), [kubernetes](), [openssf](), [oss](), [security](), [slsa](), [wolfi]() ### AI overview Chainguard's May 2023 update recaps open-source software security community activity, including talks and events, work on the Kubernetes 1.27 release, and the announcement of SLSA 1.0. ### Source excerpt Read the latest announcements in open source software security this spring including SLSA 1.0, Sigstore + npm, OpenVEX had its kickoff meeting, and more! ## Chainguard and CNCF conduct SLSA assessments for Argo and Prometheus projects DevFeed: [Chainguard and CNCF conduct SLSA assessments for Argo and Prometheus projects]() Original publisher: [Read original article]() Published: 2023-04-19T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [open-source-security](), [supply-chain-security](), [Prometheus](), [Open Source](), [Security](), [chainguard]() Tags: [argo](), [argo-cd](), [audits](), [chainguard](), [cncf](), [github](), [maintainers](), [open-source](), [prometheus](), [provenance](), [security](), [security-best-practices](), [slsa](), [slsa-levels](), [software-supply-chain-security](), [supply-chain-integrity](), [supply-chain-security]() ### AI overview Chainguard and CNCF assessed the software supply chain security of the Argo CD and Prometheus projects using the SLSA framework. Argo CD achieved SLSA Level 3 for source, build, and provenance, while Prometheus achieved Level 3 for source and build; the assessment recommended adding provenance generation to Prometheus build infrastructure. ### Source excerpt Chainguard and the CNCF partnered to conduct security assessments of Argo and Prometheus to ensure open source software projects apply security best practices. [Next page]()