8 min read
An SBOM is an ingredients list, not a safety check
What goes into a software bill of materials, what having one actually buys you, and the question it still cannot answer.
Supply Chain
7 posts tagged “Supply Chain”.
7 min read
Sign and verify your first container image with Cosign
From an unsigned image to a keyless signature anyone can verify, using Sigstore's public infrastructure. No key to lose.
7 min read
Generate an SBOM from a container image with Syft
Install Syft, scan an image or a directory, choose an output format, and wire it into CI so every build produces one.
7 min read
Getting a deeper SBOM out of cdxgen
cdxgen reads your lockfiles and build system rather than the finished image. How to run it, and when that difference matters.
7 min read
CycloneDX, the security-first bill of materials
How CycloneDX models components, dependencies and vulnerabilities, and when to pick it over SPDX.
8 min read
SPDX, the licence-first bill of materials
Where SPDX came from, how its document model is shaped, and why licence teams reach for it before security teams do.
4 min read
Supply chain security for Kubernetes
Everything between a commit and a running Pod can be attacked. Minimal and signed images, scanning in CI, locked-down pipelines and secrets, and checks at runtime.