A Secure and Integrated Approach to Software Code and Docker Image Signing: Introducing the Hybrid Chain of Trust (HCoT) Algorithm
Jamshir Qureshi · Preprints.org · 2025
Securing the software supply chain is critical in an increasingly interconnected development environment, and vulnerabilities can have implications at a widespread level. Hybrid Chain of Trust (HCoT) algorithm, a proposed new solution, integrates cutting-edge technology to address such concerns. AI-facilitated code analysis in HCoT identifies a broader range of vulnerabilities compared to traditional methods. HCoT simplifies workflows through aggregation of code and image signatures under a single, unified process. HCoT also introduces transparency to the software delivery pipeline through having recordable, verifiable proofs of vulnerability and integrity of code. With these, security professionals and developers can make trust in software delivered to them a reality.