Skip to content

Commit 0aacad1

Browse files
j28smithj28smith
committed
Some more updates after a review
1 parent 7927458 commit 0aacad1

3 files changed

Lines changed: 23 additions & 21 deletions

File tree

‎marketing/content/about.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ At **ShiftLeftCyber**, we empower organizations to:
1919
Embedded directly into your CI/CD pipelines, using industry-standard formats like **CycloneDX** and **SPDX**—allowing a comprehensive, accurate software component inventory.
2020

2121
- **Sign and verify SBOMs**
22-
Ensure both authenticity and integrity of your SBOMs through signing and verification using tools such as **Cosign** and the **JSON Signature Format (JSF)**.
22+
Ensure both authenticity and integrity of your SBOMs through signing and verification.
2323

2424
- **Analyze and remediate vulnerabilities**
2525
Leverage SBOMs to pinpoint and manage software supply chain risks—enhancing vulnerability detection, response, and remediation workflows.

‎marketing/content/securesbom_vs_sigstore.md‎

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,76 +1,78 @@
11
---
22
title: "SecureSBOM vs Sigstore"
33
description: "A side-by-side comparison between SecureSBOM and Sigstore across key criteria such as use cases, SBOM support, key management, and authentication."
4-
date: 2025-10-20
4+
date: 2025-10-21
55
draft: false
66
---
77

8-
A detailed comparison of **SecureSBOM** and **Sigstore**, two solutions addressing software supply chain integrity through signing and verification technologies.
9-
While **Sigstore** focuses primarily on open-source projects and OCI artifacts, **SecureSBOM** is built for enterprise-grade SBOM signing, verification, and compliance.
8+
A detailed comparison of **SecureSBOM** and **Sigstore**, two solutions advancing software supply chain security through SBOM signing and verification technologies.
9+
10+
While **Sigstore** focuses primarily on open-source projects and OCI artifacts, **SecureSBOM** is purpose-built for enterprise-grade SBOM signing, verification, and compliance.
1011

1112
---
1213

1314
## 🧩 Primary Use Case
1415

1516
| Tool | Description |
1617
|------|--------------|
17-
| **SecureSBOM** | Business / Enterprise Software, purpose-built for SBOM signing and verification. |
18-
| **Sigstore** | Open Source Software, OCI-Focused (SBOMs attached as a container artifact). |
18+
| **SecureSBOM** | Purpose-built for enterprise and business software, focused on SBOM signing and verification. |
19+
| **Sigstore** | Designed for open-source software with an OCI-centric approach (SBOMs attached as container artifacts). |
1920

2021
---
2122

2223
## 📘 SBOM Support
2324

2425
| Tool | Description |
2526
|------|--------------|
26-
| **SecureSBOM** | Integrates directly with the **CycloneDX SBOM format** — supports **embedded signatures**, **property exclusion**, and also supports **SPDX detached signatures**. |
27-
| **Sigstore** | Treats all SBOMs as simple blobs. Supports **detached signatures only** for both SPDX and CycloneDX. |
27+
| **SecureSBOM** | Native integration with the CycloneDX format (supports embedded signatures, property exclusion, canonicalization), and SPDX detached signatures. |
28+
| **Sigstore** | Treats SBOMs as binary blobs; supports only detached signatures for both SPDX and CycloneDX. |
2829

2930
---
3031

3132
## 🔐 Key Management
3233

3334
| Tool | Description |
3435
|------|--------------|
35-
| **SecureSBOM** | **Automated** key lifecycle management using **HSMs**. Ideal for enterprise compliance and long-term trust. |
36-
| **Sigstore** | Ephemeral, short-lived keys/certificates from **Fulcio** with **OIDC authentication** — or manual key management (local or via cloud providers like GCP/AWS). |
36+
| **SecureSBOM** | Automated key lifecycle management with HSM-backed protection; ideal for enterprise compliance and long-term trust. |
37+
| **Sigstore** | Uses ephemeral, short-lived keys and certificates issued by Fulcio with OIDC authentication, or manual key management (local or via GCP/AWS). |
3738

3839
---
3940

4041
## 🪪 Authentication
4142

4243
| Tool | Description |
4344
|------|--------------|
44-
| **SecureSBOM** | Authenticated via **API Key**, enabling fine-grained access control and multi-tenant isolation. |
45-
| **Sigstore** | OIDC (for keyless signing) or external, self-managed authentication mechanisms. |
45+
| **SecureSBOM** | API key–based authentication supporting fine-grained access control and multi-tenant isolation. |
46+
| **Sigstore** | OIDC-based authentication for keyless signing, or external self-managed authentication mechanisms. |
4647

4748
---
4849

4950
## 🔍 Transparency
5051

5152
| Tool | Description |
5253
|------|--------------|
53-
| **SecureSBOM** | **Private Record** system — verification performed using the **associated public key**, keeping enterprise signing activity confidential. |
54-
| **Sigstore** | Public record via public transparency logs. Verification relies on public keys and the public transparency logs. |
54+
| **SecureSBOM** | Maintains a private verification record. Verification is performed using the associated public key, keeping enterprise signing activity confidential. |
55+
| **Sigstore** | Uses public transparency logs for verification, relying on public keys and records visible to all. |
5556

5657
---
5758

5859
## 🧠 Summary
5960

60-
- **SecureSBOM** focuses on enterprise adoption, providing stronger SBOM format integration, private key isolation, HSM-backed signing, and internal verification capabilities.
61-
- **Sigstore** simplifies signing for open-source projects and CI/CD pipelines relying on OIDC identity proof and public transparency.
61+
- **SecureSBOM** is optimized for enterprise environments, providing deeper SBOM format integration, private key isolation, HSM-backed signing, and internal verification capabilities..
62+
- **Sigstore** streamlines signing for open-source ecosystems and CI/CD workflows through OIDC identity proofing and public transparency.
6263

6364
---
6465

6566
### ✅ Ideal Fit
6667

67-
| Use Case | Recommended Solution |
68+
| Recommended Solution | Use Case |
6869
|-----------|----------------------|
69-
| Enterprise Software & Closed Source/Private Projects | **SecureSBOM** |
70-
| Open Source Projects | **Sigstore** |
70+
| **SecureSBOM** | Enterprise software, closed-source, or private projects. |
71+
| **Sigstore** | Open-source projects and community-based CI/CD integrations. |
7172

7273
---
7374

7475
Want to learn more?
75-
- [SecureSBOM Overview](/securesbom)
76+
77+
- [SecureSBOM Overview](/securesbom)
7678
- [Sigstore Project](https://sigstore.dev)

‎marketing/hugo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ googleAnalytics = "G-CR0HB4HF2K"
6262
weight = 1
6363

6464
[[menu.main]]
65-
identifier = "securesbom_vs_cosign"
65+
identifier = "securesbom_vs_sigstore"
6666
name = "SecureSBOM vs Sigstore"
6767
url = "/securesbom_vs_sigstore/"
6868
weight = 2

0 commit comments

Comments
 (0)