Supply Chain
Can pip hash checking act as the final gate of dependency intake?
Yes, as one layer. pip hash-checking mode rejects any file that does not match a recorded hash. Here is how to use it and what it does not prove.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Is the hash an index gives pip real protection against tampering?
A hash in an index URL guards against corrupt downloads, not a hostile mirror. Why hash checking needs hashes you store yourself, and how to set them up.
Oct 19, 20263 min read
Supply Chain
Does pip's extra index URL undermine an internal package mirror?
Yes, it can. pip searches every index it is given with no priority, so a second index can bypass your mirror. Here is how to set it up safely.
Oct 19, 20264 min read
Supply Chain
What does pinned dependencies mean, and will a buyer check it?
A pinned dependency is fixed to an exact version or hash instead of a moving range. Here is what to pin, what to leave, and how to explain the choice.
Oct 19, 20264 min read
Supply Chain
Should you pin actions to a commit SHA in pull request workflows?
Pinning an action to a full commit SHA stops a moved tag from changing what runs on every outside pull request. Steps, trade offs and keeping pins current.
Oct 19, 20264 min read
Supply Chain
Should golden path base images be pinned by digest?
Pinning a base image by digest makes builds repeatable, but it also stops silent security updates. Here is how to get both with automated update PRs.
Oct 19, 20264 min read
Supply Chain
How do you pin fastlane in CI with Bundler?
Your release automation is software too. Pin fastlane with a Gemfile and committed Gemfile.lock, run it with bundle exec, and update it on purpose.
Oct 19, 20264 min read
Supply Chain
Should you pin container images by digest in Helm values?
A digest fixes an image to exact content, while a tag can move. Learn how to use digests in Helm values and Kubernetes manifests and keep them readable.
Oct 19, 20264 min read
Supply Chain
How do you pin build toolchains in a monorepo? A checklist
Pin the build tool, the language runtime and the download sources, then block silent auto-downloads in CI. A checklist with Bazel and Gradle examples.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.