DependencyTrack / DependencyTrack/dependency-track
Adding a Sigstore indicator to dependencies
Open
enhancement
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Proposed Behavior:
Issue to explore DependencyTrack being able to indicate whether a dependency has a [Sigstore](https://www.sigstore.dev) signature detected. To better cyber risk assess the software supply chain.
See also: https://github.com/CycloneDX/specification/issues/155
Contributor guide
Assessment
This issue has not been assessed yet.