Supply Chain

Which dependencies should you replace first? Use SBOM plus Scorecard

Combine your SBOM component list with OpenSSF Scorecard health checks to shortlist the dependencies most worth replacing, and what to do before you swap.

Which databases feed OSV, and which are converted from other formats?

OSV combines native format advisory databases with converted Debian, Alpine and NVD data. See the source list, what conversion changes and why coverage varies.

Where should you scan private packages: proxy, build or pull request?

Private packages need the same scanning plus a name collision defence. Route all installs through one proxy and scan at build and pull request as usual.

Where should Spark JDBC drivers come from, and where do passwords go?

Spark needs a JDBC driver jar on the classpath, and its docs show passwords in options or the URL. Source drivers from reviewed artifacts and keep secrets out.

Where does open source hide outside the lockfile?

Open source shows up outside lockfiles in base images, vendored folders, build tools, CI actions and bundled binaries. Here is where to look and how.

Where do open source maintainers announce security fixes?

Maintainers announce security fixes in several places: advisories, release notes, announce lists and oss-security. Here is how to pick which to follow.

When should you vendor a third-party library into your repository?

Vendoring copies a library into your repo. When it helps (offline builds, audit, pinning) and when it hides updates, plus a safe process if you do it.

When should you generate a container image SBOM: build, push or later?

Generate the image SBOM at build time, store it by digest, and refresh it from the registry on a schedule. Why one point in the pipeline is not enough.

When does an SBOM spreadsheet stop working? Ten warning signs

A spreadsheet can track SBOMs for a while. Ten concrete warning signs show when it is time to move to a management platform, and what to do first.

When does an SBOM management platform pay off? Five measures

An SBOM platform pays off when response time, rework, audit effort, coverage and customer requests cross thresholds you set. Five measures to track.

When a vendor SDK advisory lands, how does an inventory speed response?

A current SDK and API inventory turns a vendor advisory into three lookups: who uses it, how exposed it is, and who fixes it. Here is the sequence.

Why do Python wheels bundle shared libraries, and what does a scan see?

Tools like auditwheel copy native libraries into Linux wheels. Learn why that helps installs, and how it can hide components from a dependency inventory.