Securing Git repositories with gittuf

It's intended to be a first step in enforcing more fine grained logistical policies that big projects may wish to use for accountability & attestation along with partially automating the review process of commits. It's for larger projects needing team access controls. Ex: Bob from the UI team may not have legit access to the back end code folders, so why did he just push a 4 line function call to a new library? Should be a red flag for review or an automatic reject for insufficient access rights.

This wouldn't have solved the intentional XZ social engineering issue, and won't solve the problem of having the manpower to review new commits. But, it should give a bit more logistical control versus vanilla git it seems.

The manpower issue is only going to be solved with better (and free/cheaper/easier-to-use) behavior modeling tools. There's just not enough skilled man hours on this planet to review every bit of code for the near infinite varieties of malicious behavior or just plain old "weird machines".