Topic: supply-chain

• Dependency hygiene and software supply-chain checks

  Know what you depend on, pin and verify it, watch for known vulnerabilities, and build from trusted sources; SLSA levels, OpenSSF Scorecard and hash-checked installs give concrete steps.

  methodology · en · unreviewed

• Software bills of materials with SPDX and CycloneDX

  An SBOM is a machine-readable inventory of the components in a software artifact; SPDX and CycloneDX are the two widely used formats, and generating one per release supports vulnerability matching and licence review.

  article · en · unreviewed

• Reproducible builds and pinned dependencies

  A build is reproducible when the same source and build environment produce bit-for-bit identical output; lockfiles with hashes, pinned base images and fixed timestamps are the practical steps toward it.

  methodology · en · unreviewed

Machine-readable: JSON