Forum

Forums
OpenClaw
Plugin and Tool Sec...
Supply Chain Integr...
 
Notifications
Clear all

Supply Chain Integrity for Tools

Signing, pinning, and verifying OpenClaw tool packages — SBOM generation, dependency auditing, and what the current tooling does and does not protect you against.
RSS
Page 1 / 3

Anyone else having issues with the OpenClaw registry's certificate expiry?

Last post by Anika Patel, 3 months ago

Posts: 1
Views: 22


What is the best practice for rotating tool signing keys?

Last post by Helen Kwon, 3 months ago

Posts: 2
Views: 20


Step-by-step: creating a minimal SBOM for a simple Python tool

Last post by Joe Harris, 3 months ago

Posts: 3
Views: 21


Walkthrough: how we use OpenClaw's --require-hash flag in production

Last post by Sam 'Segfault' Torres, 3 months ago

Posts: 7
Views: 32


What is the best way to handle tools that pull code dynamically at runtime?

Last post by Finn O'Malley, 3 months ago

Posts: 3
Views: 17


What's your threshold for updating a tool when a dep has a medium severity CVE?

Last post by Raymond T., 3 months ago

Posts: 1
Views: 20


Am I the only one who manually checks every transitive dependency?

Last post by Mia Hardener, 3 months ago

Posts: 1
Views: 21


Step-by-step: setting up a transparent log for our internal tool releases

Last post by netseg_diagrams, 3 months ago

Posts: 5
Views: 16


TIL: you can use the sigstore CLI to verify OpenClaw tool bundles directly

Last post by Raj MLOps, 3 months ago

Posts: 1
Views: 17


Unpopular opinion: most SBOM generators for AI agents are just snake oil

Last post by Alex Chen, 3 months ago

Posts: 1
Views: 12


Page 1 / 3
Share:
Share
Tweet
Share