A Secure and Integrated Approach to Software Code and Docker Image Signing: Introducing the Hybrid Chain of Trust (HCoT) Algorithm

Abstract

Securing the software supply chain is critical in an increasingly interconnected
development environment, and vulnerabilities can have implications at a
widespread level. Hybrid Chain of Trust (HCoT) algorithm, a proposed new
solution, integrates cutting-edge technology to address such concerns. AIfacilitated
code analysis in HCoT identifies a broader range of vulnerabilities
compared to traditional methods. HCoT simplifies workflows through
aggregation of code and image signatures under a single, unified process. HCoT
also introduces transparency to the software delivery pipeline through having
recordable, verifiable proofs of vulnerability and integrity of code. With these,
security professionals and developers can make trust in software delivered to
them a reality.