  Software engineers integrate third-party components into their applications.
The resulting software supply chain is vulnerable. To reduce the attack
surface, we can verify the origin of components (provenance) before adding
them. Cryptographic signatures enable this. This article describes traditional
signing, its challenges, and changes introduced by next generation signing
platforms
