Software Supply Chain
In-depth guides and analysis on software supply chain from the Safeguard engineering team.
100 articles
How do you migrate Helm charts off Bitnami images safely?
Bitnami moved most images to a legacy repo and a paid tier. Audit what you deploy, mirror images you trust, override repositories and plan a replacement.
Does Maven have lockfiles? How to pin dependencies in Maven projects
Maven resolves declared versions and has no lockfile. Pin with exact versions, dependencyManagement, the enforcer plugin and checksums. Gradle has lock files.
What does a malicious Maven Central package look like?
Maven Central checks signatures and metadata, not intent. Learn the warning signs of a bad artifact, what publishing rules prove, and how to respond.
What is managed open source software and when should you use it?
Managed open source means a provider vets, builds and supports community packages for you. When it helps, when it does not and what to ask providers.
What is machine identity security and why does it matter?
Machine identities are the certificates, keys and tokens that prove software is who it says. Learn what goes wrong and how to inventory and rotate them.
How do you pin plugins and shared libraries in Jenkins?
Pin Jenkins shared libraries to a tag or commit, lock the default version, and record plugin versions so a controller rebuild gives you the same code.
How do you give Jenkins least privilege tokens and permissions?
Run Jenkins with matrix authorization and zero controller executors, scope credentials by folder, and issue narrow, short-lived tokens to each integration.
Can Jenkins produce signed provenance for the artifacts it builds?
Jenkins can run the steps, but SLSA asks what the build platform can prove. See what each build level needs and how to move a Jenkins pipeline up.
How do you secure the supply chain behind infrastructure as code?
IaC pulls in providers, modules and images you did not write. Pin versions, commit lock files, use an internal registry and review plans before they apply.
How do you vet a Packagist package before you install it?
Before composer require, check the vendor name, source repository, maintainers, scripts and plugins, then commit the lock file and run composer audit.
How do you update curl and find every copy you run?
Update curl to the latest release, then hunt for the other copies hiding in containers, language packages and vendored builds. Here is how to check each.
How do you select a base container image?
Choose a base image from a trusted source, keep it minimal, pin it by digest and rebuild on a schedule. A guide drawn from NIST SP 800-190 and Docker docs.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.