Code commonly flows downstream, from an open-source project into an organization’s own products. Upstreaming is the process of reversing that flow—contributing code back to an open-source project.

Sigstore, an open source project supported by the likes of Google, GitHub, Chainguard and RedHat, has become somewhat of a standard for signing, verifying and protecting software projects — and ...