SBOM and Signing Tooling Guidance

Recent comparisons of SBOM tools (Syft vs Trivy, SBOM Lens) and signing tools (Cosign vs Notation) provide actionable guidance. DIY trusted supply chain pipeline tutorials using Sigstore/Cosign, self-hosted Rekor, and Kyverno admission policies offer hands-on implementation. Artifact immutability enforcement is emphasized. A new practical CI/CD security checklist covers SBOM, dependency scanning, SAST, secret detection, and artifact signing.