Hacker News Reader

Would it be correct to say that "Sigstore" is only for containers and not all software?

I'm genuinely confused. Does this also apply to "user-facing" software such as CLI tools or GUIs?

Good question, cosign is a client that works with containers OCI / registries. We are also develop clients to work with pypi, rust cargo and cases such as helping to protect against curl | bash attacks

Reply on news.ycombinator.com