The Whole Is Greater Than the Sum of Its Parts - A Case for Interoperable Supply Chain Tooling

Explore the critical importance of interoperable supply chain security tooling in this 23-minute conference talk from CNCF. Discover how foundational projects like in-toto and DSSE, along with newer initiatives such as Sigstore, SLSA, Minder, and GUAC, can work together more effectively despite current interoperability challenges. Learn about the gaps that exist when organizations across the supply chain use different tooling approaches, including varying methods for storing signature information and encoding data at rest. Examine practical approaches to bridge these gaps and understand the remaining work needed to achieve seamless tool integration. Gain insights into how combining these security frameworks can unlock their full potential for strengthening software supply chain security across upstream suppliers and downstream users.