Software Supply Chain
In-depth guides and analysis on software supply chain from the Safeguard engineering team.
100 articles
Sigstore vs GPG signing: which fits your releases?
GPG signs with a long lived key you manage. Sigstore signs with short lived certificates tied to an identity and logs the event. Pick by who verifies.
How do RubyGems lockfiles and version pinning work?
Gemfile.lock pins every gem, direct or transitive, with SHA-256 checksums. Learn what to commit, how deploys use it and how a cooldown delays new releases.
How do NuGet lock files and version pinning work?
Turn on RestorePackagesWithLockFile, restore in locked mode in CI, and pin the SDK so a NuGet build resolves the same package graph every time.
How do you start a software supply chain security program in logistics?
Start a logistics software supply chain program in 90 days: inventory critical systems, tier vendors, collect SBOMs from the top tier, set response rules.
How do you manage JavaScript dependencies securely with npm?
A practical npm workflow: commit the lockfile, install with npm ci, audit with a failure threshold, verify signatures, and control install scripts in CI.
How does a healthtech team start a supply chain security program?
A 90 day plan for healthtech teams: inventory components, tie it to HIPAA safeguards, add secure development steps, and prepare SBOM and breach duties.
How do you run a private Go module proxy that acts as a gatekeeper?
A private Go proxy is a simple HTTP server. Point GOPROXY at it, set GONOSUMDB for private paths, and return 403 for modules you have not approved.
How do you generate an SBOM for a Rust project?
Commit Cargo.lock, run cargo cyclonedx for a CycloneDX file, embed dependency data with cargo auditable, and run both only on code you trust.
How do you run a private mirror or proxy for crates.io?
Cargo can swap crates.io for a mirror or vendored copy through source replacement. Learn the config, the rules and what a mirror does and does not protect.
Why did Maven 3.8.1 start blocking HTTP repositories?
Maven 3.8.1 blocks external HTTP repositories by default after CVE-2021-26291. Learn what broke, why, and how to fix your builds without undoing it.
What does the xz backdoor teach about attestation?
The xz backdoor hid in release tarballs that differed from git. See how signed provenance makes that mismatch checkable, and what attestation cannot prove.
What is the Open Container Initiative (OCI) and why does it matter?
The OCI sets open standards for container images, runtimes and registries, so tools interoperate. Learn what that means for supply chain security.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.