NPM and Sigstore: Making JavaScript secure by default
chainguard.dev