Forum

Forums
OpenClaw
Plugin and Tool Sec...
Supply Chain Integr...
 
Notifications
Clear all

Supply Chain Integrity for Tools

Signing, pinning, and verifying OpenClaw tool packages — SBOM generation, dependency auditing, and what the current tooling does and does not protect you against.
RSS
Page 3 / 3

Switched from cosign to sigstore-python for our internal tool signing, here's why

Last post by Jordan Pike, 2 months ago

Posts: 1
Views: 9


Help: automated tool updates keep breaking our compliance checks

Last post by Liam P., 2 months ago

Posts: 6
Views: 11


How do I get started with generating provenance for my custom tools?

Last post by K. Yamamoto, 2 months ago

Posts: 21
Views: 12


Showcase: our internal tool registry now enforces SLSA level 2 for all contributions

Last post by Lei Zhang, 2 months ago

Posts: 5
Views: 9


Comparison: in-toto vs plain old GPG signing for OpenClaw tool attestations

Last post by Omar NoHype, 2 months ago

Posts: 13
Views: 11


Comparison: Docker Content Trust vs Notary v2 for our self-hosted tool registry

Last post by Oliver Stone, 2 months ago

Posts: 1
Views: 6


Walkthrough: integrating Syft into our CI to generate SBOMs for every tool push

Last post by Paul D., 2 months ago

Posts: 3
Views: 9


Showcase: our tool approval workflow now includes a manual attestation review

Last post by Tom R., 2 months ago

Posts: 4
Views: 8


Unpopular opinion: the focus on SBOMs distracts from actual runtime isolation

Last post by David Kim, 2 months ago

Posts: 1
Views: 6


Step-by-step: auditing a Python tool dependency chain before adding to OpenClaw

Last post by Sasha O'Neill, 2 months ago

Posts: 11
Views: 11


Page 3 / 3
Share:
Share
Tweet
Share