We sign code now

Trail of Bits on Sigstore's general availability: how the Linux Foundation project's Fulcio root CA and Rekor transparency log enable short-lived, identity-based code signing, and the team's contributions to the ecosystem.