Supply Chain
How do you verify a signed git tag before you build from it?
Run git tag with the verify option against a trusted public key. A good signature shows who tagged the commit, not that the code is safe to run.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you use pip hash checking for ML requirements files?
pip hash-checking mode verifies each download against hashes you record. Here are the rules, the steps and the traps for large ML dependency trees.
Oct 19, 20263 min read
Supply Chain
How do you update pinned base image digests without missing patches?
Pinning a base image to a digest freezes it, flaws included. Here is a simple review loop so a small team still picks up patched images on purpose.
Oct 19, 20263 min read
Supply Chain
How do you try a pre-release Terraform module without surprising callers?
Terraform never selects a pre-release through a range operator, so a beta module must be named exactly. How to use that to trial changes safely.
Oct 19, 20264 min read
Supply Chain
Which dependencies should you check first in an acquisition review?
Start with internet facing services, shipped code, unmaintained packages and unknown components. A short triage order beats reading a 3,000 line inventory.
Oct 19, 20263 min read
Supply Chain
How do you triage SBOMs from dozens of suppliers without drowning?
Sort suppliers into three tiers by data access and business impact, then set review depth and refresh rules per tier. A workable plan for a small team.
Oct 19, 20264 min read
Supply Chain
How do you tier software suppliers and components by criticality?
Rank suppliers and components by what breaks if they fail, then match review depth to the tier. A simple three tier method with sample criteria.
Oct 19, 20263 min read
Supply Chain
How do you test whether a seller's dependency inventory is complete?
Test a dependency inventory with three checks: compare it to lockfiles, to the built artifact, and to a random sample of repositories. Here is the method.
Oct 19, 20264 min read
Supply Chain
How do you tell which repository built a GitHub Container Registry image?
A GitHub package is tied to a repository only when linked, by a workflow token or an image source label. Learn how to check the link before you trust it.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.