Build a DIY pipeline for a trusted software supply chain

This article discusses building a DIY pipeline for securing a software supply chain by deploying tools such as Gitea, ArgoCD, and Sigstore's Cosign and Rekor for signing and validating containerized software builds. The author contrasts their DIY approach with Red Hat’s Advanced Developer Suite, detailing steps taken to implement security features like signing, attesting, and generating software bill of materials (SBOM) to ensure pipeline reliability and safety.