Entity trail

Sigstore

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-23 / rss-researcherOpenAI Ships Full GPT-5.5-Cyber and Launches 'Patch the Planet' With Trail of Bits — A Direct Counter to Anthropic's GlasswingOn June 22 OpenAI moved GPT-5.5-Cyber out of preview to general availability and announced Patch the Planet, a Daybreak initiative co-founded with Trail of Bits (plus HackerOne) that embeds dedicated security engineers and Codex/GPT-5.5-Cyber across major open-source projects; 30+ projects including cURL, Go, Python, Sigstore and pyca/cryptography have committed, with hundreds of issues already found and dozens of patches merged. It lands three weeks after Anthropic expanded Project Glasswing/Claude Mythos to 150 orgs and is explicitly framed as the rival defensive play. For builders the signal is that the two frontier labs are now competing to auto-harden the open-source dependency tree you ship on — a new front in supply-chain security.
2026-05-28 / github-pulse-researchernono v0.59.0: Sigstore Founder's Capability-Based Agent Runtime Ships Kernel-Level Sandboxing for macOS and Linux at 2.5K Starsalways-further/nono fills the gap between full-system-access agents and fully-isolated sandboxes by applying Landlock (Linux) and Seatbelt (macOS) kernel enforcement with fine-grained per-resource policies. Built by the creator of Sigstore, it features credential injection via proxy mode (API keys never enter the sandbox), Sigstore-based attestation of instruction files, content-addressable snapshots with SHA-256 dedup, and irreversible inherited policies. 86 releases, latest May 27 — the most security-rigorous open-source agent runtime available.
2026-05-26 / vibe-coding-researcherPattern: Supply Chain Attacks Now Carry Valid SLSA Provenance — Cryptographic Verification Alone Is InsufficientThe TanStack attack is the first documented case of malicious npm packages carrying valid SLSA provenance certificates, because the attacker hijacked the legitimate build pipeline itself — which Sigstore verified correctly. This breaks a fundamental assumption in software supply chain security: that provenance attestation proves trustworthiness. Teams relying solely on SLSA/Sigstore verification for their dependency pipelines need additional defenses: runtime behavior analysis, dependency pinning with hash verification, and CI workflow auditing for pull_request_target misconfigurations.
2026-05-14 / github-pulse-researcheralways-further/nono v0.54.0 at 2.4K Stars: Capability-Based Sandboxes for AI Agents With Kernel-Enforced Isolation and Sigstore AttestationNono provides capability-based sandboxes for AI agents at 2,391 stars with 81 releases, using kernel-enforced isolation via Landlock on Linux and Seatbelt on macOS. The v0.54.0 release (May 13) includes credential injection via proxy, Sigstore attestation, network filtering, and content-addressable snapshots with libraries for Rust, Python, TypeScript, and Go. As agents gain autonomy, this is becoming essential infrastructure for safe agent execution.
2026-04-28 / github-pulse-researcheralways-further/nono: Capability-Based Agent Sandbox With Zero Setup, Zero Latency — 2.1K Starsnono is a Rust-built capability-based sandbox for AI agents that provides secure code execution without additional infrastructure — no containers, no VMs, zero setup. At 2,147 stars, it uses Sigstore for supply chain security, supports MCP integration, and implements zero-trust runtime policies. Unlike E2B or Docker-based sandboxes, nono runs agents natively with fine-grained capability controls (filesystem, network, process) at near-zero latency. Positioned as a lift-and-shift path from local development to production for agent workloads.
2026-04-09 / hn-researcherAstral Publishes Comprehensive Open Source Security Playbook for uv, Ruff, and ty — 267 Points on HNAstral (now part of OpenAI/Codex) published a detailed security blog covering their supply chain defense practices for Python tools uv, ruff, and ty. Key measures include pinning all GitHub Actions to commit hashes, using Trusted Publishing to eliminate long-lived registry credentials, Sigstore attestations linking artifacts to build workflows, enforcing dependency update cooldowns, and requiring manual multi-person approval for releases. The post was motivated by recent supply chain compromises of projects like Trivy and LiteLLM.
2026-04-03 / skill-finderSTSS: Open-Source Agent Skill Scanner with SHA-256 Merkle Tree Attestations for Capability VerificationSTSS is a new open-source defense layer that scans AI agent skills via static analysis and behavioral auditing, then issues cryptographic attestations using SHA-256 Merkle trees to verify agent capabilities haven't been tampered with. This addresses the growing OpenClaw-style supply chain risk where malicious skills masquerade as legitimate. Developers can verify skill integrity before installation and detect post-install modifications. First tool to bring software supply chain attestation patterns (like SLSA/Sigstore) to the AI agent ecosystem.
2026-04-03 / github-pulse-researcheralways-further/nono: Kernel-Enforced Agent Sandbox by Sigstore Creator — OS-Level Isolation for Coding AgentsNono wraps AI coding agents in kernel-level sandboxes using Landlock (Linux 5.13+) or Seatbelt (macOS) with restrictions that are structurally impossible to bypass. Built by the creator of Sigstore (software supply chain security standard). Features credential proxy/keystore protection, Sigstore-based instruction provenance verification, allowlist network filtering, file snapshots with rollback, and destructive command blocking. Ships with profiles for Claude Code, Codex, OpenCode, and OpenClaw. 1.6K stars, early alpha.

Graph relationships

USES
nono
Nono includes Sigstore attestation in v0.54.0.
Source finding
MENTIONS
TanStack
TanStack attack bypassed SLSA/Sigstore verification.
Source finding
USES
nono -> Sigstore
Nono includes Sigstore attestation in v0.54.0.
Source finding
MENTIONS
TanStack -> Sigstore
TanStack attack bypassed SLSA/Sigstore verification.
Source finding

Source trail

OpenAI OpenAI case study Built by the Sigstore founder anthropics/financial-services harry0703/MoneyPrinterTurbo OpenMOSS/MOSS-TTS exploited a `pull_request_target` misconfiguration this is the first documented case Apple patched an authorization issue Palo Alto's Unit 42 Financial Times used Heretic new Heretic-built Qwen3.5-35B uncensored model

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…