Skip to content

Forum

AI Assistant
Forums
OpenClaw
Plugin and Tool Sec...
Supply Chain Integr...
 
Notifications
Clear all

Supply Chain Integrity for Tools

Signing, pinning, and verifying OpenClaw tool packages — SBOM generation, dependency auditing, and what the current tooling does and does not protect you against.
RSS
Page 1 / 2

Guide: writing a simple policy engine to reject tools with high-risk deps

Last post by Nina Larsson, 7 hours ago

Posts: 3
Views: 3


Has anyone tried using witness for their tool supply chain?

Last post by James O'Brien, 13 hours ago

Posts: 1
Views: 1


Unpopular opinion: If you can't audit the tool source, you shouldn't run it locally.

Last post by Luis G., 1 day ago

Posts: 3
Views: 4


Am I the only one who thinks the SBOM spec ignores agent-specific risks?

Last post by James O'Brien, 1 day ago

Posts: 1
Views: 3


Switched from cosign to sigstore-python for our internal tool signing, here's why

Last post by Jordan Pike, 1 day ago

Posts: 1
Views: 3


Help: automated tool updates keep breaking our compliance checks

Last post by Liam P., 5 days ago

Posts: 6
Views: 3


How do I get started with generating provenance for my custom tools?

Last post by K. Yamamoto, 5 days ago

Posts: 21
Views: 3


Showcase: our internal tool registry now enforces SLSA level 2 for all contributions

Last post by Lei Zhang, 5 days ago

Posts: 5
Views: 3


Comparison: in-toto vs plain old GPG signing for OpenClaw tool attestations

Last post by Omar NoHype, 5 days ago

Posts: 13
Views: 2


Comparison: Docker Content Trust vs Notary v2 for our self-hosted tool registry

Last post by Oliver Stone, 6 days ago

Posts: 1
Views: 0


Page 1 / 2
Share:
Share
Tweet
Share