Supply Chain
Is a git dependency in Cargo safe? Branch, tag and rev compared
How Cargo locks git dependencies, what branch, tag and rev each mean, and how to keep a git dependency reviewable and pinned to one commit hash.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do I stop unknown registries and git crates in Cargo?
Use the cargo deny sources check to fail builds when a Rust crate comes from an unapproved registry or git repo. Keys, defaults and a safe rollout.
Oct 18, 20263 min read
Supply Chain
How do I ban crates and duplicate versions with cargo deny?
The cargo deny bans check blocks named crates, flags duplicate versions and wildcard requirements. Keys, defaults, skip options and a rollout plan.
Oct 18, 20263 min read
Supply Chain
How should I set yanked and unmaintained rules in cargo deny?
The cargo deny advisories table controls yanked crates, unmaintained crates and ignores. Defaults, what each value does and a practical policy.
Oct 18, 20263 min read
Supply Chain
Can cargo audit scan a compiled Rust binary?
cargo audit can check a compiled binary with its bin subcommand. Accuracy depends on whether it was built with cargo auditable. What to expect.
Oct 18, 20263 min read
Supply Chain
Can you verify Sigstore signatures offline? What a bundle holds
A Sigstore bundle packs the certificate, signature and log evidence needed to verify later. What it contains, what it still needs, and how to test it.
Oct 18, 20263 min read
Supply Chain
Can you publish VEX without an SBOM?
Yes. CISA says VEX is designed to integrate with SBOMs but does not require one. See what you lose without an SBOM and how to name products instead.
Oct 18, 20263 min read
Supply Chain
Can you overwrite a published package version on a registry?
No. npm, PyPI, Maven Central and crates.io treat a published version as permanent. What each one lets you do instead, and why that protects your builds.
Oct 18, 20264 min read
Supply Chain
Can you delete a package version from GitHub Packages? Rules and limits
Private versions can be deleted. Public ones only if under 5,000 downloads. Restore works for 30 days. What to do when you need a bad version gone.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.