José Miguel Parrella

#### Problem Description `install.sh` uses the output of `lsb_release` to imply an APT-based system before calling `apt-get`. It currently tests for Debian and Ubuntu, leaving other Debian-derived systems unsupported. ####...

Unprivileged podman and buildah and reproducibility?

6

Thank you for putting together this example, it has been tremendous learning for me and I'm sure many others. Is `cargo build` expected to happen in the container? If so,...

The Artifact attestor chokes trying to stat the target of a dangling symlink

1

When using `witness` to supervise a Debian package build, I noticed the `Artifact` attestor breaking when trying to `lstat()` the target of a dangling symlink. This dangling symlink was produced...

Support for podman (or also, removing hard docker dependency)

23

## Describe the proposal In standalone mode, it'd be nice to have `podman` support in `dapr` (and perhaps `daprd`) at least for `dapr init` and basic `dapr run` use cases....

There are several good references in https://github.com/chughes757/SecureSoftwareSupplyChain and most importantly a simple categorization.

See https://holisticsecurity.io/2020/02/10/security-along-the-sdlc-for-cloud-native-apps/

As of September 2022, the content is largely bootstrapped and a new taxonomy/flow seems to be emerging. A few subtasks for this milestone are: * Reads should roughly be in...

See https://github.com/cncf/landscapeapp/issues/818

See https://twitter.com/colek42c/status/1536383951417315328?s=12&t=M2KE1ox2tzi0u_1Hrnq7Uw

Sounds like readers might benefit from a link to a good curation there.