Developer Tools

What is manylinux and when does a Python library need it?

Manylinux is the platform tag that lets one Linux wheel run on most distributions. Learn when you need it, what musllinux adds, and how it ties to glibc.

What is llms.txt, and should your docs site publish one?

llms.txt is a proposed Markdown index for AI agents. What the proposal says, what Google says about it, and a low risk way to decide for your docs.

What is Landlock, and how is it different from seccomp?

Landlock lets an unprivileged process restrict its own file and network access. Seccomp filters system calls instead. See how they differ and combine.

What is inside a Python sdist and a wheel, file by file?

An sdist is a tarball with source, pyproject.toml and PKG-INFO. A wheel is a zip with installed files and a dist-info folder. Here is what each contains.

What is in a container image reference? Host, repository, tag and digest

A container image reference has a host, namespace, repository and tag, with defaults for each. Why bare names are risky and how to pin a digest.

What is gitsign and how does keyless Git commit signing work?

Gitsign signs Git commits with a short-lived Sigstore certificate tied to your identity. Setup, verification and the limits to know before you adopt it.

What is GitLab Advanced SAST and when does cross-file analysis help?

GitLab Advanced SAST traces untrusted input across functions and files. Learn what taint analysis is, how to enable it, and the limits to plan for.

What is CloudFormation Guard and what does it not check?

CloudFormation Guard is an open source policy as code tool for JSON and YAML. It does not lint templates or enforce on the server by itself.

What is bubblewrap, and when should you use it to sandbox a tool?

Bubblewrap builds unprivileged Linux sandboxes from user namespaces. It supplies parts, not policy. Learn what it does, its limits and when it fits.

What is an Airflow constraints file, and do you need one?

An Airflow constraints file pins a tested set of dependency versions. See how it works, what it does not cover, and how to keep your own copy.

What is an AAR file and what should you inspect inside it?

An AAR is a zip of an Android library with manifest, classes, resources and native code. Learn what each part is and what to check before you add one.

What is a software catalog and why does vulnerability work need one?

A software catalog is a registry of components, APIs, systems and owners. See what it holds, and how it turns scanner findings into routed, owned work.