DigiCert has added Secure Releases to its Software Trust Manager, giving organizations a way to assess software risk when a release is published and monitor it as vulnerability information changes. The functionality is part of the DigiCert ONE platform and brings together data on supported GitHub releases, software bills of materials (SBOMs), known vulnerabilities, severity, and security scan results.
Teams can use the release-level information to identify versions that may need attention and inform software signing and release workflows. Secure Releases is intended to help address a gap in software security: signing can verify who produced software and whether it has been changed, but it does not show whether a component becomes vulnerable after release.
Monitor SBOMs and release risk
Finding affected software versions can require teams to compare repository data, SBOMs, vulnerability databases, and scan results. Secure Releases brings these details together by release. Software Trust Manager also provides functions to:
- Sign software and cryptographic inventories: Sign SBOMs and cryptographic bills of materials (CBOMs) so recipients can verify their source and integrity.
- Review release risk: View dependencies, SBOMs, vulnerabilities, severity, and supported scan results for each release, and monitor for new risks as vulnerability information changes.
- Identify affected releases: Find releases that contain a vulnerable component and alert the responsible teams. Premium users can also find a version of the component that fixes the vulnerability when one is available.
- Set release policies: Establish vulnerability and SBOM requirements and, where supported, prevent signing or release if those requirements are not met.
- Share security evidence: Sign security evaluations, VEX statements, SLSA attestations, and SARIF reports for customers and auditors.
Availability and vulnerability monitoring
Secure Releases is available in Software Trust Manager Essentials, Advanced, and Premium
“Software signing proves where code came from and whether it has been altered, but those assurances do not tell teams whether a release contains a newly discovered vulnerability dependency,” said Deepika Chauhan, Chief Product Officer at DigiCert.
“Secure Releases brings those pieces together. By connecting release risk to the same policies that govern signing and delivery, organizations can respond faster when exposure changes and keep software from moving forward when it does not meet their requirements.”
Secure Releases is available in Software Trust Manager Essentials, Advanced, and Premium. Essentials provides a point-in-time assessment of release risk, while Advanced and Premium continuously monitor release SBOM results as vulnerability information changes. Premium also suggests a newer component version when a fix is available and allows organizations to block signing or release when software fails to meet their security requirements.
